BrowserDownload collector

The BrowserDownload collector shows the BrowserDownload entries of a Windows operating system.

Collector output

Field	Type	Description
browser	String	Name of the browser used for downloading. The possible values are: Google Chrome Mozilla Firefox Microsoft Edge
browser_profile	String	The browser profile used for downloading.
end_time	String	Time when the download ended. The string represents the FILETIME structure which is 64-bit. This value represents the number of 100-nanosecond intervals since January 1, 1601 (UTC).
file_path	String	The name of the downloaded file with the full path.
mime_type	String	This string indicates Multipurpose internet Mail Extensions type. It's a way of identifying files according to their nature and format.
received_bytes	int	Number of bytes received.
referrer	String	The webpage that requested the download.
site_url	String	The URL of the site from where the file is downloaded.
start_time	String	Time when the download started. The string represents the FILETIME structure which is 64-bit. This value represents the number of 100-nanosecond intervals since January 1, 1601 (UTC).
state	int	The state indicates whether the download was completed successfully.
total_bytes	int	Total size of the file for which the download was initiated .
user_profile	String	The user profile used for downloading.

Example: Show browser downloads from URLs that have the trellix.com domain

BrowserDownload where BrowserDownload site_url contains "trellix.com"

Which browsers are used in my environment

BrowserDownload browser

Prevalence - downloads by mimetype

BrowsewrDonload mime_type, total_bytes

Prevalence - downloads by binary type

BrowserDownload mime_type, file_path
    WHERE BrowserDownload mime_type contains "octet-stream"

Prevalence - downloads by zip archive type

BrowserDownload mime_type, file_path
    WHERE BrowserDownload mime_type equals "application/zip"

Prevalence - downloads by many compressed archive type

BrowserDownload mime_type, file_path
    WHERE BrowserDownload mime_type equals "application/zip"
        OR BrowserDownload mime_type equals "application/x-zip-compressed"
        OR BrowserDownload mime_type equals "application/x-tar"

Prevalence - websites offering downloads of binary type

BrowserDownload site_url, mime_type
    WHERE BrowserDownload mime_type contains "octet-stream"

Specify single target website

BrowserDownload site_url, mime_type
    WHERE BrowserDownload mime_type contains "octet-stream"
        AND BrowserDownload site_url contains "github.com"

Specify many target websites

BrowserDownload site_url, mime_type
    WHERE BrowserDownload mime_type contains "octet-stream"
        AND BrowserDownload site_url contains "github.com"
            OR BrowserDownload site_url contains "drive.google.com"
            OR BrowserDownload site_url contains "super.com"

Specify single target filename

BrowserDownload site_url, mime_type, file_path
    WHERE BrowserDownload mime_type contains "octet-stream"
        AND BrowserDownload file_path contains "zoom.exe"

Specify many target filenames

BrowserDownload site_url, mime_type, file_path
    WHERE BrowserDownload mime_type contains "octet-stream"
        AND BrowserDownload file_path contains "foo.exe"
            OR BrowserDownload file_path contains "bar.exe"
            OR BrowserDownload file_path contains "baz.exe"

Prevalence - downloads by web referrer and web provider

BrowserDownload referrer, site_url
    WHERE BrowserDownload referrer not equals ""
        AND BrowserDownload site_url not equals ""

Specify download by referrer to provider combination

BrowserDownload referrer, site_url
    WHERE BrowserDownload referrer contains "evil_foo.com"
        AND BrowserDownload site_url not equals "drive.google.com"