Chrome Management
| eventName | Description | Sample | Rule |
|---|---|---|---|
| any | Source-only rules that filter on applicationName 'chrome' without specifying an eventName attribute here. | N | N |
| badNavigationEvent | A Chrome browser user navigated to a site blocked by Safe Browsing. | N | Y |
| contentTransferEvent | A content transfer (upload or download) was detected by Chrome Enterprise. | N | Y |
| dangerousDownloadEvent | A Chrome user downloaded a file flagged as dangerous by Safe Browsing. | N | Y |
| unscannedFileEvent | A Chrome user attempted to download a file that could not be scanned for malware. | N | Y |
| CHROME_ | A user logged in to a Chrome OS device. | N | N |
| CHROME_ | A user logged out of a Chrome OS device. | N | N |
| CHROME_ | A login attempt on a Chrome OS device failed. | N | N |
| DLP_ | A Chrome Enterprise data loss prevention policy was triggered. | N | N |
| PASSWORD_ | A Chrome user reused a corporate password on a non-corporate site. | N | N |
| DEVICE_ | A Chrome OS device changed its boot state (e.g. verified boot status changed). | N | N |
any: Chrome Management (any event)
#Description
Source-only rules that filter on applicationName 'chrome' without specifying an eventName attribute here.
References #
contentTransferEvent: Content Transfer Event
#Description
A content transfer (upload or download) was detected by Chrome Enterprise.
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →YARA-L #
T1566↳ also matches badNavigationEvent: Bad Navigation Event, dangerousDownloadEvent: Dangerous Download Event, unscannedFileEvent: Unscanned File Event
References #
dangerousDownloadEvent: Dangerous Download Event
#Description
A Chrome user downloaded a file flagged as dangerous by Safe Browsing.
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →YARA-L #
T1566↳ also matches badNavigationEvent: Bad Navigation Event, contentTransferEvent: Content Transfer Event, unscannedFileEvent: Unscanned File Event
References #
unscannedFileEvent: Unscanned File Event
#Description
A Chrome user attempted to download a file that could not be scanned for malware.
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →YARA-L #
T1566↳ also matches badNavigationEvent: Bad Navigation Event, contentTransferEvent: Content Transfer Event, dangerousDownloadEvent: Dangerous Download Event
References #
CHROME_OS_LOGIN_EVENT: Chrome OS Login Event
#Description
A user logged in to a Chrome OS device.
References #
CHROME_OS_LOGOUT_EVENT: Chrome OS Logout Event
#Description
A user logged out of a Chrome OS device.
References #
CHROME_OS_LOGIN_FAILURE_EVENT: Chrome OS Login Failure
#Description
A login attempt on a Chrome OS device failed.
References #
DLP_EVENT: DLP Event
#Description
A Chrome Enterprise data loss prevention policy was triggered.
References #
PASSWORD_REUSE: Password Reuse
#Description
A Chrome user reused a corporate password on a non-corporate site.