Suspicious Chrome Extension Installation or Modification

Information hacker@Informationhacker

•updated Feb 10, 2026•30•0•216

This rule detects the creation or modification of Chrome extension files (.crx) on a device, correlating it with browser extension installation/update events and file prevalence. It flags extensions that are rare, unsigned, small in size, or have suspicious IDs, indicating potential malicious activity or unauthorized installations.