Correlation Rule
Medium
✕
Chrome - Known Malware Downloaded
User $xdm.source.user.username downloaded the file $xdm.target.file.filename via chrome profile $$xdm.intermediate.user.username on $xdm.source.host.hostname.
- Module:
- Platform Analytics
- Data source:
- google_workspace_chrome_raw
- Category:
- Execution
- Content pack:
- Google Chrome
ATT&CK tactics: Execution (TA0002)
ATT&CK techniques: User Execution: Malicious File (T1204.002)
- Execution:
- REAL_TIME
- Search window:
XQL query:
datamodel dataset = google_workspace_chrome_raw | filter xdm.event.type = "MALWARE_TRANSFER" and xdm.observer.action = "BYPASSED" | fields xdm.event.type, xdm.event.description, xdm.observer.action, xdm.event.outcome_reason, xdm.source.user.username, xdm.intermediate.user.username, xdm.source.host.hostname, xdm.source.host.os, xdm.source.host.os_family, xdm.network.http.browser, xdm.network.http.url, xdm.source.user_agent, xdm.target.file.filename, xdm.target.file.size