Chrome AI Model Re Download After Deletion Persistence
Last updated on:
In this page
About the rule
Rule Type
Advanced
Rule Description
Correlates deletion of weights.bin in Chrome OptGuideOnDeviceModel directory followed by re-creation on the same host within 60 minutes, indicating Chrome silently re-downloads the AI model after admin removal.
Severity
Critical
Rule Requirement
Criteria
Action1:
actionname = "File deleted" AND (( OBJECTNAME contains "OptGuideOnDeviceModel" OR FILENAME contains "OptGuideOnDeviceModel" ) AND ( OBJECTNAME contains "weights.bin" OR FILENAME contains "weights.bin" ))
Action2:
actionname = "File Created or Modified" AND (( OBJECTNAME contains "OptGuideOnDeviceModel" OR FILENAME contains "OptGuideOnDeviceModel" ) AND ( OBJECTNAME contains "weights.bin" OR FILENAME contains "weights.bin" )) AND HOSTNAME = Action1.HOSTNAME
sequence:Action1 followedby Action2 within 60m
select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.DOMAIN,Action1.PROCESSNAME,Action1.ACCESSLIST,Action1.OBJECTNAME,Action1.FILENAME,Action1.FILETYPE,Action2.HOSTNAME,Action2.MESSAGE,Action2.USERNAME,Action2.DOMAIN,Action2.OBJECTNAME,Action2.FILENAME,Action2.PROCESSNAME,Action2.FILETYPE,Action2.ACCESSLIST
Detection
Execution Mode
realtime
Log Sources
Windows
