BadBlocker Extension Supply-Chain Risk: Unistream SDK and Malicious C2 Domains
This rule monitors network logs (proxy, DNS, network) for connections to domains associated with the Unistream SDK. This SDK has been identified as a component of the BadBlocker malicious Chrome extension family, which facilitates unauthorized background activity. The rule serves as an indicator of potential command and control (C2) communication from a compromised host.
Splunk (SPL)
