Operator On The Wire
Join
← Back to Knowledge Base
BLUE TEAM / THREAT HUNT / WINDOWS / NETWORK

INTERNET

This note documents detection patterns related to Internet Activity within Windows environments.


Direct Indicators

LogEvent IDMeaningForensic ValueNotes
Sysmon3Network connectionCriticalDirect outbound internet communication.
Sysmon22DNS queryCriticalDomain resolution before web activity.
Security5156Allowed connectionHighWindows Filtering Platform outbound traffic.
Security4688Browser process launchHighBrowser or LOLBIN internet access initiation.
PowerShell4104Download cradle / web retrievalCriticalScript-based internet retrieval.
Bits-Client59 / 60BITS transferHighBackground download activity.
NetworkProfile10000Network connectedHighInternet-capable network entered.

Indirect Indicators

IndicatorWhat To Look ForForensic ValueNotes
Browser launched then DNSUser browsing or staged retrievalCriticalCommon internet chain.
DNS without browserBackground app / malware / beaconCriticalOften hidden activity.
Short browser session + downloadPayload retrievalCriticalHigh attacker relevance.
Private browsing artifacts missingIntentional concealmentHighCorrelate with cache remnants.
Search terms before compromiseUser intentHighOften explains later artifacts.
Repeated failed domainsBeacon fallback / typo / dead C2HighUseful malware clue.

Common Tools

ToolUsage
sqlite3Parse browser databases
BrowsingHistoryViewQuick browser triage
HindsightChrome forensic parsing
Registry ExplorerTyped URLs / browser config
EvtxECmdNetwork logs
KAPEBrowser artifact collection

Relevant Artifacts

Chrome / Edge History

  • C:\Users\<user>\AppData\Local\Google\Chrome\User Data\Default\History
  • C:\Users\<user>\AppData\Local\Microsoft\Edge\User Data\Default\History

Downloads

  • SQLite table: downloads

Cookies

  • SQLite table: cookies

Cache

  • Browser cache folders

Typed URLs (Legacy / IE)

  • HKCU\Software\Microsoft\Internet Explorer\TypedURLs

WebCache (Legacy)

  • WebCacheV01.dat

DNS

  • DNS Client logs
  • Sysmon Event 22

Network Support

  • DHCP
  • NetworkProfile
  • WLAN

Registry Interpretation

Registry AreaUsageForensic ValueNotes
TypedURLsManual typed destinationsCriticalStrong user intent evidence
TypedURLsTimeTimingHighWhen manually entered
Internet SettingsProxy / zone configHighProxy abuse / tampering
Start PageBrowser landing behaviorMediumUser profile context

MITRE ATT&CK References

  • T1071 Application Layer Protocol
  • T1105 Ingress Tool Transfer
  • T1566 Phishing
  • T1041 Exfiltration Over C2 Channel

Decision Tree

  1. Which browser?

    • Chrome
    • Edge
    • Firefox
    • IE
  2. User intent?

    • Search
    • Typed URL
    • Direct download
  3. Network corroboration?

    • DNS
    • Sysmon 3
    • DHCP active
  4. File impact?

    • Download
    • Cache
    • Child process
  5. Scope:

    • User browsing
    • Malware retrieval
    • Beacon traffic

Example Detection Templates

KQL

DeviceNetworkEvents
| where InitiatingProcessFileName in ("chrome.exe","msedge.exe","firefox.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP

EQL

sequence by host.name with maxspan=5m
  [ process where process.name in ("chrome.exe","msedge.exe") ]
  [ network where process.name in ("chrome.exe","msedge.exe") ]

Sigma

title: Browser Internet Activity
id: browser-internet-01
status: experimental
description: Detects browser outbound activity
author: Vergil
date: 2026-03-11
logsource:
  product: windows
detection:
  selection:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  condition: selection
fields:
  - Image
  - CommandLine
falsepositives:
  - Normal browsing
level: low
tags:
  - attack.command-and-control

Mitigation & Hardening

Control AreaMitigationEffectivenessNotes
Browser loggingRetain browser artifactsCriticalPrimary user internet evidence
DNS loggingEnable DNS visibilityCriticalStrongest supporting layer
Proxy monitoringDetect hidden redirectionHighMalware often abuses proxies
Download controlAlert suspicious downloadsCriticalPayload pr

Investigator Notes

  • Browser DB must be queried with SQLite, not opened raw.

  • TypedURLs often prove deliberate user action.

  • Downloads table frequently survives when cache is partial.

  • DNS often proves activity even when browser history is cleaned.

  • Browser history alone is weak without network correlation.