← All techniques

mitre att&ck technique

T1204.002

Malicious File

View T1204.002 on attack.mitre.org

1 post cover this technique

2026-09-25

Browser History for Initial Access: Collecting and Querying Chromium History

When the EDR shows PowerShell or a suspicious download but not how the user got there, the browser's SQLite history usually does. Find the right profile, collect a copy, and query it in DB Browser for SQLite.

DFIRInitial AccessTriage 8 min read