Browsers

Kind

State - something true when Signal read the host

Built-in rules reading it

3

browser.name

string

The browser, by the folder its profiles are in (Google Chrome, Microsoft Edge, Opera, Mozilla Firefox ...); a Chromium build Signal does not know is "Chromium-based" with its folder.

browser.profile

string

The browser profile's folder.

browser.user

string

The Windows account whose profile the browser profile is in - its profile folder's name and SID.

extension.id

string

The extension's ID: for Chromium-based browsers 32 letters, the same in every one of them; for Gecko the add-on's ID.

extension.name

string

The extension's name as its manifest declares it (in its default language) - chosen by its author, so it can imitate another's.

extension.version

string

The extension's version as its manifest declares it.

extension.manifest_version

int

The manifest version (Chromium: 2 or 3); absent when not recorded.

extension.installed_by

string

How the browser records it was installed: store; package file (not a store); policy; external program (registry, preferences file, folder, placed in the profile); unpacked folder; command line (--load-extension); temporary (loaded for debugging); the browser's own.

extension.from_store

bool

true when the browser records it as from its store, or it updates from a browser's own store (Chrome Web Store, Edge Add-ons, Opera add-ons, Firefox Add-ons) - a store reviewed it once, which does not make it safe.

extension.update_url

string

Where the browser fetches the extension's updates from, as its manifest or the browser records it; absent for none. Whoever runs that server can change the extension.

extension.folder

string

The folder holding the extension's files.

extension.installed

time

When the browser records the extension was first installed in this profile (Chromium's first install time, Gecko's install date).

extension.state

string

enabled, or why not, as the browser records it (disabled by the user, disabled by the browser with its own reason code); the browser checks it again when it next starts.

extension.signature

string

The browser's record of the extension's signature, where it keeps one (Gecko's signedState: signed, not signed, signature broken ...); absent for Chromium, whose store signs the files it serves.

extension.permissions

string

The API permissions the extension declares (Chromium's manifest; Gecko's granted list), comma-separated.

extension.sites

string

The sites the extension may read and change - host permissions and content-script matches - comma-separated.

extension.capabilities

string

What its permissions let it do, in words: read and change every site; read cookies; see or block web requests; debug pages; talk to programs on this computer; change the proxy; manage other extensions; read browsing history - semicolon-separated. What it may do, not what it did.
derived: from extension.permissions and extension.sites, by providers/browsers

extension.forced_by

string

The policy value that forces the extension on the browser (ExtensionInstallForcelist), with its registry key; absent when none does.

extension.in_period

bool

true when the extension was installed inside the period the analyst gave (the profile's window); absent when no period was given.
derived: set by the Browsers module from extension.installed and its since parameter

Kind

Event - something that happened at a time

Its time is

download started (browser history)

Built-in rules reading it

9

browser.name

string

The browser, by the folder its profiles are in (Google Chrome, Microsoft Edge, Opera, Mozilla Firefox ...); a Chromium build Signal does not know is "Chromium-based" with its folder.

browser.profile

string

The browser profile's folder.

browser.user

string

The Windows account whose profile the browser profile is in - its profile folder's name and SID.

download.target

string

Where the file was saved, as the browser recorded it (or the file found with a Mark of the Web).

download.url

string

The address the file was served from: the last of the URL chain the browser recorded, else the Mark of the Web's HostUrl. Cut at 2048 characters.

download.chain

string

Every address the download went through, as requested first and served from last (redirects in between), separated by " -> ".

download.referrer

string

The page that linked to the download, as the browser or the Mark of the Web (ReferrerUrl) recorded it.

download.tab_url

string

The page open in the tab the download started from (Chromium).

download.tab_referrer

string

The page that led to the page the download was started from (Chromium).

download.page_reached

string

How the history says the page the download was started from was reached on its latest visit - typed in the address bar, followed a link (from which site), redirected, submitted a form, opened from a bookmark ...; absent when the history keeps no visit of it.

download.started

time

When the download started, as the browser recorded it; for a file known only by its Mark of the Web, absent (the record's time is then the file's creation).

download.ended

time

When the download ended, as the browser recorded it.

download.last_opened

time

When the file was last opened from the browser, as the browser recorded it (Chromium); absent when it was not.

download.state

string

How the download ended, as the browser recorded it: complete, cancelled, interrupted, failed, in progress, blocked as dangerous ...

download.danger

string

The browser's own verdict on the download, worded from its recorded value: dangerous file type, dangerous URL, possibly dangerous content, uncommon content, flagged by the browser and kept by the user, potentially unwanted ...; absent when it recorded none.

download.opened

string

The browser's own record of whether the file was opened from the browser's downloads list (Chromium): yes, or no - which says nothing of a run by any other way (download.ran says what Executions found).

download.mime

string

The content type the server declared - chosen by the server.

download.by_extension

string

The browser extension that started the download, when one did (Chromium) - name and ID.

download.size

int

The size the browser recorded, in bytes.

download.kind

string

What kind of file it is - executable, installer, script, shortcut, disk image, archive, Office document with macros, OneNote, browser extension package - from its first bytes when it is on disk, else its name. Only these kinds are read; other downloads are not.
derived: by providers/browsers from download.format, else the file's extension

download.format

string

What the file's first bytes say it is (executable (PE), ZIP archive, disk image (ISO) ...); absent when it is not on disk or not recognised.

download.disguised

string

Why the file's name hides what it is, when it does: "content is an executable" with a name ending in another extension, or "name puts" a document's extension before an executable one (invoice.pdf.exe).
derived: by providers/browsers from download.format and the file's name

download.on_disk

string

Whether the file is at the recorded path now: present; not at the recorded path (moved, renamed or deleted); or not checked, and why (a network or removable drive is never touched).

download.mark

string

The file's Mark of the Web - its zone (3: Internet) and where it says the file came from; absent when the file has none (copied, extracted by a tool that drops it, or the mark removed).

download.url_host

string

The host the file was served from (lower case, no port).

download.url_scope

string

When the address it was served from is a bare IP address, its scope (public, private, loopback ...); absent for a host name.
derived: by providers/browsers from download.url

download.sources

string

Where the download is known from: the browser's history (and which database), the file's Mark of the Web.

download.ran

string

Evidence that the downloaded file ran, from Executions' records of the same path or a command line naming it - the source and time of each (Prefetch, BAM, DAM, PCA, process creation, running now). For a program, script or shortcut with none: "no evidence of a run found in" the sources searched, and those not searched and why - absence of evidence, never proof it did not run.
derived: by the Browsers module from Executions' evidence

download.persists

string

The persistent entries configured to run the downloaded file, from Persistence's records - each "service <name>", "scheduled task <path>" or "auto-start <location>: <entry>". For a program, script or shortcut with none: "none found in" the entries read, and those not read and why.
derived: by the Browsers module from Persistence's evidence

download.in_period

bool

true when the download (or, known only by its Mark of the Web, the file's creation) is inside the period the analyst gave (the profile's window).
derived: set by the Browsers module from the record's time and its since parameter

file.signer

string

Who signed the entry's program: the name on the signing certificate (Microsoft Windows, Microsoft Corporation, a vendor), from the file's own signature or the Windows catalog that lists it. Empty when unsigned or not checked.
derived: verified by Signal with WinVerifyTrust (embedded signature, else the system catalogs)

file.signature

string

The program's signature: valid, invalid (signed, but the signature or its chain does not verify), unsigned, or not found (no such file). Absent when it could not be checked.
derived: verified by Signal (as file.signer)

file.sha256

string

The SHA-256 of the entry's program (lower-case hex), as found at its path when Signal ran - absent when the file was not found or could not be read.
derived: computed by Signal from the file's content

file.sha1

string

The SHA-1 of the same file, computed in the same read as file.sha256 - for matching threat reports and Sysmon, which still name files by it.
derived: computed by Signal from the file's content

file.md5

string

The MD5 of the same file, computed in the same read as file.sha256 - for matching threat reports and Sysmon, which still name files by it.
derived: computed by Signal from the file's content

Kind

Event - something that happened at a time

Its time is

last visit (browser history)

Built-in rules reading it

2

browser.name

string

The browser, by the folder its profiles are in (Google Chrome, Microsoft Edge, Opera, Mozilla Firefox ...); a Chromium build Signal does not know is "Chromium-based" with its folder.

browser.profile

string

The browser profile's folder.

browser.user

string

The Windows account whose profile the browser profile is in - its profile folder's name and SID.

visit.host

string

A site visited in a browser profile - its host name or address, lower case - with its pages' visits summed. Only a site a rule matches is reported; the history is never listed.

visit.scope

string

When the site is a bare IP address, its scope (public, private, loopback ...); absent for a host name.
derived: by providers/browsers from visit.host

visit.tld

string

The site's top-level domain (the host name's last label, with its dot: .zip, .top); absent for an address.
derived: by providers/browsers from visit.host

visit.count

int

Its pages' visit counts summed, as the browser keeps them (it drops old visits).

visit.first

time

The earliest visit to any of its pages the browser keeps (it drops old visits).

visit.last

time

The latest visit to any of its pages the browser keeps.

visit.typed

int

How many times its addresses were typed in the address bar - the browser's own count.

visit.how

string

How its visits were reached, with counts, most first: typed in the address bar, followed a link, redirected, submitted a form, opened from a bookmark, chosen from an address-bar suggestion, back or forward, reloaded ... - from each visit's transition (Chromium) or visit type (Gecko).

visit.from

string

The other sites that led to it - the page each visit came from, or a referrer from outside the browser - with counts, most first (up to five).

visit.time_spent

string

How long its pages were open, summed, as the browser recorded it (Chromium) - open, not necessarily looked at.

visit.urls

string

Up to three of its pages, most recent first, separated by " | ". Cut at 2048 characters each.