Chrome Browser Safe Browsing User Bypass

/*
 * Copyright 2023 Google LLC
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     https://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

rule chrome_browser_safe_browsing_user_bypass {

  meta:
    author = "Google Cloud Security"
    description = "Detects and alerts on users bypassing Chrome Safe Browsing warnings and accessing potentially dangerous content or downloads"
    rule_id = "mr_73e2a3d4-13ba-47ef-b250-a2bdcd98dc48"
    rule_name = "Chrome Browser Safe Browsing User Bypass"
    mitre_attack_tactic = "Initial Access"
    mitre_attack_technique = "Phishing: Spearphishing Link"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1566/002/"
    mitre_attack_version = "v14.1"
    type = "alert"
    tags = "chrome enterprise"
    data_source = "Chrome Management"
    severity = "Low"
    priority = "Low"

  events:
    $process.metadata.product_name = "Chrome Management"
    (
        $process.metadata.product_event_type = "badNavigationEvent" or
        $process.metadata.product_event_type = "dangerousDownloadEvent" or
        $process.metadata.product_event_type = "contentTransferEvent" or
        $process.metadata.product_event_type = "unscannedFileEvent"
    )
    $process.security_result.action_details = "EVENT_RESULT_BYPASSED"
    $process.security_result.category_details = $category
    strings.coalesce($process.principal.user.email_addresses, $process.principal.hostname ) = $user

  match:
    $user over 5m

  outcome:
    $risk_score = max(
      if ($category = "", 10) +
      if ($category = "THREAT_TYPE_UNSPECIFIED", 20) +
      if ($category = "SSL_ERROR", 30) +
      if ($category = "UNWANTED_SOFTWARE", 50) +
      if ($category = "DANGEROUS", 60) +
      if ($category = "SOCIAL_ENGINEERING", 70) +
      if ($category = "DANGEROUS_HOST", 80) +
      if ($category = "MALWARE", 90)
    )
    $instances = count_distinct($user)
    $suspicious_url = array_distinct($process.target.url)
    $suspicious_file_sha256 = array_distinct($process.target.file.sha256)
    $principal_user_userid = array_distinct($user)

condition:
  // To reduce the number of alerts to just higher risk events, uncomment the value in the line below
  $process // and $risk_score >= 50
}