Browsers
On this page
Browsers answers: what came in through a browser, and what in a browser works for someone else?
At a glance
Question | What came in through a browser, and what in a browser works for someone else? |
Reads | Every profile of every Chromium- and Gecko-based browser of every user: extensions, downloads, history (matched only), and the Mark of the Web. |
Never reads | Cookies, saved passwords and form data. |
Rule prefix |
|
What it reads
Extensions
Every extension of every profile (browser_extension): how it was installed (store, policy, sideloaded), what it may do (its permissions and the sites it may read), the policy forcing it, its update URL. Every extension is listed for stacking across hosts.
Downloads
Files downloaded that run or carry code - executables, installers, scripts, shortcuts, disk images, archives, Office documents with macros, OneNote files, extension packages (file_download). From the browsers' history, read by Signal's own read-only database reader, and from the Mark of the Web on files in every user's Downloads and Desktop. Each download is joined to what ran and what persists: did it run? is it set to start again?
Visits
Sites visited (browser_visit), per profile, read only to be matched by rules: how each site was reached (typed, a link, a redirect), from where, the first visit and the time spent.
Browsers started for remote control
A browser started with a remote debugging switch can be driven by another program; the process rules look for it.
Signals it raises
16 rules: 2 high, 9 medium, 5 low. The full text of each is in the rule catalog.
ID | Severity | Title | Evidence | ATT&CK |
|---|---|---|---|---|
| high | A downloaded file whose name hides what it is |
|
|
| high | A downloaded file is configured to run again |
|
|
| medium | A file downloaded from a bare Internet address |
|
|
| medium | A downloaded script or shortcut ran |
|
|
| medium | A downloaded program or installer that is not validly signed |
|
|
| medium | A download the browser flagged was kept by the user |
|
|
| medium | A browser started with an extension loaded from a folder (--load-extension) |
|
|
| medium | A browser extension not installed from a store |
|
|
| medium | A browser extension whose signature is missing or broken |
|
|
| medium | A browser started for remote control (remote debugging) |
|
|
| medium | A site visited by its bare Internet address |
| - |
| low | A program or script downloaded by a browser extension |
|
|
| low | A file downloaded from a file-sharing, paste or tunnel service |
|
|
| low | A file that runs or carries code downloaded in the period given |
| - |
| low | A browser extension that may read every site and its cookies, debug pages, change the proxy or talk to local programs |
|
|
| low | A site visited under a top-level domain often abused |
| - |
How to read it
A download's chain: its URL, the page it was started from, how that page was reached. A file whose name disguises its type is flagged.
download.ransays whether Signal found evidence that it ran - and which sources it searched. "No evidence found" names what was not searched.Extensions: one on one host of a thousand, installed outside the store, with access to every site, deserves a look.
What it can't see
Next
Webshells: the sites this host serves.