BrowserHistory collector

The BrowserHistory collector shows the BrowserHistory entries of a Windows operating system.

Collector output

Field	Type	Description
url	String	URL of the visited webpage.
title	String	Title of the visited webpage.
last_visit_time	String	Time of last visit. The string represents the FILETIME structure which is a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 (UTC).
visit_count	int	Number of times the URL was visited.
visit_from	String	The website from which this webpage was reached.
browser	String	Name of the browser which accessed this webpage. The possible values are: Google Chrome Mozilla Firefox Microsoft Edge Microsoft Internet Explorer
user_profile	String	The user profile used to access the webpage.
browser_profile	String	The browser profile used to access the webpage.
url_length	int	The length of the URL string.
typed_count	int	The number of times the address of the webpage was typed in the browser .

Supported versions

Windows	Linux	macOS
3.0 and later	N/A	N/A

Example: Show visited URLs that have the trellix.com domain

BrowserHistory where BrowserHistory url contains "trellix.com"

Hunting for indicators of attack - IoAs: http activity

BrowserHistory visit_count, url, browser
    WHERE BrowserHistory url_length greater than "255"
        AND BrowserHistory url contains "pastebin.com"