SNOWBELT - Keep-Alive Tab Injection (T1176)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•1•0•4

Detects background JavaScript workers injecting helper files to ensure the extension remains active. This rule specifically looks for the creation of files named 'helper.html', 'dream.html', or 'dream.js' within the Microsoft Edge extension data folder, which is indicative of the SNOWBELT malware's persistence mechanism.