chrome_browser_safe_browsing_user_bypass

rule chrome_browser_safe_browsing_user_bypass {

  meta:
    author = "Google Cloud Security"
    description = "Detects and alerts on users bypassing Chrome Safe Browsing warnings and accessing potentially dangerous content or downloads"
    rule_id = "mr_73e2a3d4-13ba-47ef-b250-a2bdcd98dc48"
    rule_name = "Chrome Browser Safe Browsing User Bypass"
    mitre_attack_tactic = "Initial Access"
    mitre_attack_technique = "Phishing: Spearphishing Link"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1566/002/"
    mitre_attack_version = "v14.1"
    type = "alert"
    tags = "chrome enterprise"
    data_source = "Chrome Management"
    severity = "Low"
    priority = "Low"

  events:
    $process.metadata.product_name = "Chrome Management"
    (
        $process.metadata.product_event_type = "badNavigationEvent" or
        $process.metadata.product_event_type = "dangerousDownloadEvent" or
        $process.metadata.product_event_type = "contentTransferEvent" or
        $process.metadata.product_event_type = "unscannedFileEvent"
    )
    $process.security_result.action_details = "EVENT_RESULT_BYPASSED"
    $process.security_result.category_details = $category
    strings.coalesce($process.principal.user.email_addresses, $process.principal.hostname ) = $user

  match:
    $user over 5m

  outcome:
    $risk_score = max(
      if ($category = "", 10) +
      if ($category = "THREAT_TYPE_UNSPECIFIED", 20) +
      if ($category = "SSL_ERROR", 30) +
      if ($category = "UNWANTED_SOFTWARE", 50) +
      if ($category = "DANGEROUS", 60) +
      if ($category = "SOCIAL_ENGINEERING", 70) +
      if ($category = "DANGEROUS_HOST", 80) +
      if ($category = "MALWARE", 90)
    )
    $instances = count_distinct($user)
    $suspicious_url = array_distinct($process.target.url)
    $suspicious_file_sha256 = array_distinct($process.target.file.sha256)
    $principal_user_userid = array_distinct($user)

condition:
  // To reduce the number of alerts to just higher risk events, uncomment the value in the line below
  $process // and $risk_score >= 50
}