BadBlocker/Unistream Chrome Extension Network Beaconing to Known Malicious Domains

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•2

This rule detects the installation or update of known malicious browser extensions followed by network communication to identified command-and-control or malicious infrastructure domains. It also monitors for direct network beaconing to these malicious domains, providing defense-in-depth even if installation telemetry is absent.