#kql

Hoping someone can chime in, i'm at a wall at the moment. So, i've come across a scenario where i have a couple of users devices that are downloading crypto token icons in SVG format to a directory that is then deleted. From all of the evidence gathered, it look slike this is all happening within 30 seconds on the devices. We manage Chrome with policies. We have a whitelist for plugins and extensions. I located this, while searching for something else in our XDR logs. C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\acala-token.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\acala.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\ape-token.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\ape.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\arc-native-token-logo.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\avax-token.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\iotex-token.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\iotex.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\karura-token.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\karura.svg We've manually checked the users device, installed extensions/plugins, we've used KQL queries to try to locate the root of this, however, the way Chrome works, it hides the information we're looking for. I've even gone through all the chrome://chrome-urls/ to see if i could locate anything. We've compared job roles, of the users and they have nothing in common. One of the new ones located had this information Process event: chrome.exe --utility-sub-type=unzip.mojom.Unzipper Time: 7:21:46 PM File events (10 SVGs): Time: 7:22:11 PM Folder:Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\ Delta = ~25 seconds What is excluded in all of the logs on the device and in our Defender system, is if this is an extension, what the ID or name is if it is. I know or at least I know that the CRX also handles Chrome updates. But in either case, I need to find out what is download icons for crypto currency then deleting it. The users event viewer shows nothing, as these events are not logged, so I am hoping someone might know a way to dig deeper into Chrome to figure this out. This is the Initiating Process Command Line for just about everyone of these entries "chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --no-pre-read-main-dll --metrics-shmem-handle=5840,i,2169236920772237475,2071396139152657378,524288 --field-trial-handle=1940,i,9109780936433903204,1179441795768105101,262144 --variations-seed-version=20260630-171645.651000-production --pseudonymization-salt-handle=1956,i,16028727218760239160,14674054428472284321,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=5868 /prefetch:14 #Chrome #KQL #Defender

---------------- 🛠️ Clankerusecase — Threat-led Detection Library =================== Clankerusecase is a threat-led detection library providing detection rules across four platforms: Microsoft Defender KQL, Azure Sentinel KQL, Sigma, and Splunk SPL. The core value is reducing latency between threat intelligence publication and deployable detection content. 🔹 Two Content Tiers Generic use cases are rule files stored in use_cases/*.yml that activate when an article mentions a known trigger keyword. For example, an article referencing psexec fires the rule UC_LATERAL_PSXEC. These are broadly applicable but lack specificity to individual campaigns. They provide baseline coverage for well-known techniques and tools. AI-badged use cases represent a higher-fidelity tier. The pipeline feeds the source article to Claude, which generates bespoke detection logic targeting the exact campaign, threat actor, or malware family described. These rules are pinned to the specific IOCs and TTPs mentioned in the article. AI-badged use cases sort to the top of article cards and the matrix drawer to surface the highest-quality content first. 🔹 Cross-Verification Process AI-generated detections undergo a cross-verification step via web search against authoritative vendor advisories: Microsoft Threat Intelligence, Mandiant, CrowdStrike, MITRE ATT&CK, and abuse.ch. Each AI-badged rule includes "Cross-checked against:" references linking back to these verification sources. This adds a validation layer that pure LLM-generated detection rules typically lack. 🔹 Platform Coverage and Filtering Detection rules target four platforms, each with its own query language. The interface provides filter groups organized by Source, Content, Platform, Target, and Splunk category. On mobile viewports, the filter toolbar collapses behind a "Filters ▾" toggle to keep article cards above the fold. 🔹 Practical Considerations For detection engineers, the AI-badged use cases offer campaign-specific hunting logic without starting from scratch. The cross-check against vendor advisories provides some confidence, though this does not replace manual validation in production. The generic rules provide baseline coverage for known patterns, while AI rules address the gap for novel or recently reported threats. The quality of AI-generated rules depends on Claude's ability to accurately extract IOCs and TTPs from source articles. 🔹 detection_engineering #KQL #sigma #splunk #tool 🔗 Source: https://clankerusecase.com/