Cross-Campaign - Ext Install Forcelist + Credential Access

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•6

This rule detects a suspicious sequence of events: first, a modification to the 'ExtensionInstallForcelist' registry key, followed within one hour by access to browser credential stores (specifically 'Login Data' or 'Cookies' files). This combination suggests an attacker might be attempting to force the installation of a malicious browser extension to steal credentials.