Google's Chrome browser stores cookies that can reveal valuable insights into user behavior, including login details, session durations, and frequently visited sites.

On Windows, this information is stored in the following location:

C:\Users\[Username]\AppData\Local\Google\Chrome\User Data\Default\Network\cookies.

This database file can be opened in software such as DB Browser For SQLite. The ‘cookies' table is of interest to understand recent activity within Chrome.

Sections

ID	Name	Description
IF010	Exfiltration via Email	A subject uses electronic mail to exfiltrate data. This can be achieved through including data in the email subject line or body, or utilizing email attachments to send files.
IF008	Inappropriate Web Browsing	A subject accesses web content that is deemed inappropriate by the organization.
IF018	Sharing on AI Chatbot Platforms	A subject interacts with a public Artificial Intelligence (AI) chatbot (such as ChatGPT and xAI Grok), leading to the intentional or unintentional sharing of sensitive information.
MT020	Ideology	A subject is motivated by political, philosophical, religious, social, or other ideological beliefs to engage in an infringement against an organization. Such infringements may include unauthorized access, data exfiltration, destruction of information, sabotage, or violations of organizational policy undertaken to advance, defend, or draw attention to a particular cause or belief system. Ideological motivation arises when a subject's beliefs influence their decision to act against the interests or established rules of an organization. The subject may perceive their actions as morally justified, necessary, or consistent with a broader political, philosophical, or social objective, even where those actions result in organizational harm. During an investigation, ideological motivation should be established through evidence linking the subject's expressed objectives or beliefs to the infringement. The possession or expression of ideological beliefs alone does not establish malicious intent or constitute evidence of an insider threat.
IF010.001	Exfiltration via Corporate Email	A subject exfiltrates organizational information using a corporate-issued email account, either through an installed email application or webmail. The information may be transmitted to an external recipient or retained within the mailbox for subsequent unauthorized retrieval.
IF010.002	Exfiltration via Personal Email	A subject exfiltrates organizational information using a personal email account or another mailbox accessible to them, either through an installed email application or webmail. The information may be transmitted to an external recipient or retained within the mailbox for subsequent unauthorized retrieval.
IF008.001	Lawful Pornography	A subject accesses lawful pornographic material from an organization device, contravening internal policies on acceptable use of organization equipment.
IF008.002	Unlawful Pornography	A subject accesses unlawful pornographic material from a organization device, contravening internal policies on acceptable use of organization equipment and potentially, the law.
IF008.003	Terrorist Content	A subject accesses, possesses and/or distributes materials that advocate, promote, or incite unlawful acts of violence intended to further political, ideological or religious aims (terrorism).
IF008.004	Extremist Content	A subject accesses, possesses, or distributes materials that advocate, promote, or incite extreme ideological, political, or religious views, often encouraging violence or promoting prejudice against individuals or groups.
IF008.005	Gambling	A subject accesses or participates in online gambling from a corporate device, contravening internal policies on acceptable use of company equipment.
IF008.006	Inappropriate Usage of Social Media	A subject misuses social media platforms to engage in activities that violate organizational policies, compromise security, disclose confidential information, or damage the organization’s reputation. This includes sharing sensitive data, making unauthorized statements, engaging in harassment or bullying, or undertaking any actions that could risk the organization’s digital security or public image.
IF008.007	Gaming	A subject accesses or participates in web-based online gaming from a corporate device, contravening internal policies on acceptable use of company equipment.
IF008.008	Other Inappropriate Content	A subject accesses other inappropriate web content from a corporate device, contravening internal policies on acceptable use of company equipment.
ME006.006	Code Repositories	A subject can access websites used to access or manage code repositories.
PR025.002	File Download via Browser	The subject downloads files using a web browser (e.g., Chrome, Edge, Firefox) from external or internal web resources. This is the most common and lowest-friction method of file acquisition, typically requiring no additional tooling or elevated privileges. Browser-based downloads are often logged via proxy, CASB, or endpoint telemetry, but may still present challenges in environments with encrypted traffic or limited content inspection. This behavior is frequently associated with early-stage preparation, including retrieval of tools, scripts, or datasets from public repositories, file-sharing platforms, or personal cloud storage.
ME006.008	Generative AI Websites	A subject can access generative AI websites.