Suspicious Browser Extension File Write and Registry Modification

Awais Munir@iawais

•updated Oct 27, 2025•3•0•39

This rule detects the creation of executable files (.exe, .dll, .pyd) within browser extension folders (Chrome, Edge, Firefox) followed by a related registry modification within a one-hour window. This behavior is indicative of malicious browser extension installation or modification, often used for persistence or data exfiltration.