KongTuke NexShield Chrome Extension Sideload via Non-Chrome Process
Detects potential sideloading of malicious Chrome extensions by monitoring for unauthorized file creation of 'manifest.json' files within the browser's extension directories and unauthorized registry modifications related to extension management. The rule specifically excludes legitimate processes like 'chrome.exe' and 'GoogleUpdate.exe', aiming to identify third-party processes attempting to register or install browser extensions.
Microsoft Sentinel (KQL)
