Application Collecting Device Information via Google Analytics

F S@Fsdr

•updated Dec 10, 2025•46•4•308

This rule detects applications, other than common web browsers, that are making network connections to Google Analytics domains and also contain 'microsoft' in the remote URL. This could indicate an application collecting device information or other telemetry and exfiltrating it via Google Analytics, potentially for malicious purposes or unauthorized data collection.