Detection of Known Malicious Browser Extensions
This rule detects the presence of known malicious browser extensions on devices. It identifies extensions based on a curated list of Extension IDs associated with various threats, including Urban VPN, extensions that turned malicious, general malicious browser extensions, and those involved in Chrome extension supply chain attacks. The rule queries `DeviceTvmBrowserExtensions` to find any activated extensions matching these IDs.
Microsoft Sentinel (KQL)
