DarkSpectre Malicious Browser Extensions
Detects the installation of malicious browser extensions associated with the DarkSpectre threat actor, which includes the ShadyPanda, Zoom Stealer, and GhostPoster campaigns. Detection is based on known malicious extension IDs observed in file paths and registry keys for Chrome, Edge, and Firefox.
Sigma
