BadBlocker extension MAIN-world script injection then data exfil to api.adblock-for-youtube.com
Detects potential malicious browser extension activity by correlating internal browser process network connections to suspicious infrastructure (e.g., adblock-for-youtube.com) with subsequent network traffic from the same process PID to third-party domains within 60 seconds of visiting sensitive high-value websites (e.g., login portals, banking). The rule also alerts on any direct network connection to identified malicious exfiltration infrastructure.
Microsoft Sentinel (KQL)
