DarkSpectre-Associated Browser Extension Network Activity
Identifies outbound network connections from endpoints to domains associated with the DarkSpectre malicious browser extension campaigns, including Zoom Stealer, ShadyPanda, and GhostPoster infrastructure. This query is intended to support threat hunting and incident investigation by highlighting browser-initiated communications to known high-confidence infrastructure used for real-time data exfiltration, surveillance, and remote payload delivery. Results should be reviewed in context with initiating process, user activity, and installed browser extensions.
Microsoft Sentinel (KQL)
