Suspicious Browser Popups from Windows Toast Notification
This detection aims to identify suspicious popup activity on devices by analyzing process events that launch notifications. The query focuses on detecting referrers that generate multiple unique popup URLs, which could indicate potentially malicious behavior. You can use this to check for potential browser popups generated by malicious sites gaining notification permission on a browser before they lead to further compromise of a host.
Microsoft Sentinel (KQL)
