BadBlocker Chrome Extension with <all_urls> Permission and Known Malicious Extension IDs
Detects the presence of known malicious browser extensions by their extension ID or extensions that declare overly permissive host access ('<all_urls>') in combination with suspicious naming conventions associated with common ad-blocking malware.
Splunk (SPL)

