ChatGPT Stealer Browser Extension Installation
This rule detects the installation of known malicious browser extensions associated with the ChatGPT Stealer campaign. These extensions are designed to steal AI session tokens and conversation data by monitoring file creation or renaming events in directories where browser extensions are typically installed.
Microsoft Sentinel (KQL)
