Malicious Extension declarativeNetRequest Abuse via perplexity-ai.online
Detects the presence of malicious Chromium browser extension artifacts related to the 'Search for perplexity ai' extension. This extension abuses Manifest V3 declarativeNetRequest permissions (such as declarativeNetRequestFeedback and declarativeNetRequestWithHostAccess) to intercept and redirect network requests to the attacker-controlled domain 'perplexity-ai.online'. The rule specifically identifies the extension's rule resource files (e.g., perplexity-rules.json) and specific file paths associated with the extension ID.
Microsoft Sentinel (KQL)
