Browser Search Hijacking via Manifest Override
Detects the creation or modification of a browser extension's manifest.json file that overrides the default search provider to a known malicious or suspicious domain. This technique is used by extensions like 'DPS Websafe' and 'Stock Informer' for search hijacking.
Sigma
