Browser History File Accessed via SMB for Recon

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•3

This rule detects attempts to access browser history files, specifically Google Chrome's history, over Server Message Block (SMB) protocol. The detection is triggered when SMB traffic contains the string "History" and "AppData\Local\Google\Chrome" (case-insensitive), indicating a potential reconnaissance activity where an attacker might be trying to exfiltrate or analyze browser history.