Malicious Browser Extension DNS Activity

Bhojraj Joshi@cybrbhojrajjoshi

•updated Apr 17, 2026•12•0•202

This rule detects DNS requests to domains known to be associated with malicious browser extensions. These extensions often perform command and control (C2) or data exfiltration activities by communicating with these domains. The rule uses a regex to match both the primary domains and their subdomains, aggregating results by host and domain to identify repetitive beaconing.