Chrome - User Phished and/or Password Re-use/Breach event

Correlation Rule Medium

Chrome - User Phished and/or Password Re-use/Breach event

The user $xdm.source.user.username had $xdm.event.type event via $xdm.intermediate.user.username chrome profile, which resulted in $xdm.observer.action.

Module:: Platform Analytics
Data source:: google_workspace_chrome_raw
Category:: Infiltration
Content pack:: Google Chrome

ATT&CK tactics: Initial Access (TA0001)

ATT&CK techniques: Phishing (T1566) Valid Accounts (T1078)

Execution:: REAL_TIME
Search window:

XQL query:

datamodel dataset = google_workspace_chrome_raw 
| filter (xdm.event.type in ("UNSAFE_SITE_VISIT") and xdm.observer.action = "BYPASSED" and xdm.event.description contains "SOCIAL_ENGINEERING") or (xdm.event.type in ("PASSWORD_BREACH", "PASSWORD_REUSE"))
| fields xdm.event.type, xdm.event.description, xdm.observer.action, xdm.event.outcome_reason, xdm.source.user.username, xdm.intermediate.user.username, xdm.source.host.hostname, xdm.source.host.os, xdm.source.host.os_family, xdm.network.http.browser, xdm.network.http.url, xdm.source.user_agent, xdm.target.file.filename, xdm.target.file.size

Open the full correlation rule →