Network connection to Google passkey enclave or caBLE hybrid transport domain (ua5v.com) - verify source process is non-browser, unsigned, or otherwise anomalous; exclude legitimate chrome.exe browser process traffic

Duo Tech@duotech

•updated Aug 3, 2026•0•0•3

Detects a network connection to Google's passkey enclave or caBLE hybrid-transport domain (*.ua5v.com) that should be correlated with EDR process telemetry to confirm the source process is non-browser, unsigned, or otherwise anomalous rather than the legitimate Chrome browser.