Detection of Known Malicious Browser Extensions (Urban VPN, 1ClickVPN)
This rule detects the presence of known malicious browser extensions, specifically Urban VPN, Urban Browser Guard, Urban Ad Blocker, and 1ClickVPN Proxy, across Chrome and Edge browsers. It identifies these extensions by searching for their unique 32-character Extension IDs within file paths or file names associated with device file events. The rule then enriches the findings with the extension's name and the browser it belongs to.
Microsoft Sentinel (KQL)
