BadBlocker Adblock for YouTube scripletsRules MAIN-world JS Injection via Remote API
This rule detects network activity associated with known malicious browser extensions identified as 'AdBlock' variants. It monitors for connections to the domain 'api.adblock-for-youtube.com' or requests to '/api/v2/rules' made by specific extension IDs that are known to perform unauthorized or suspicious activities.
Splunk (SPL)

