Suspicious Browser Extensions Installed (CrowdStrike)

Detects non-allowlisted browser extensions with risky names/permissions or TLD indicators in CrowdStrike Falcon InstalledBrowserExtension events.

Sigma