Chrome Gemini Nano Model File Creation Detected
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects silent creation of the Gemini Nano AI weights file in the Chrome OptGuideOnDeviceModel directory without user consent.
Severity
Attention
Rule Requirement
Criteria
Action1:
actionname = "File Created or Modified" AND ( PROCESSNAME endswith "\chrome.exe" AND ( OBJECTNAME contains "OptGuideOnDeviceModel" OR FILENAME contains "OptGuideOnDeviceModel" ) AND ( OBJECTNAME contains "weights.bin" OR FILENAME contains "weights.bin" ))
select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.DOMAIN,Action1.OBJECTNAME,Action1.FILENAME,Action1.PROCESSNAME,Action1.FILETYPE,Action1.ACCESSLIST
Detection
Execution Mode
realtime
Log Sources
Windows
