AiFrame Malicious Browser Extension Activity

This query detects network traffic and file events associated with the "AiFrame" malicious browser extension campaign. These extensions pose as AI assistants but exfiltrate user data via remotely controlled iframes.

Microsoft Sentinel (KQL)