Malicious Extension Search Hijack to perplexity-ai.online (proludey)
Detects browser search traffic being hijacked to the typosquatted domain 'perplexity-ai.online' by the malicious Chromium extension 'Search for perplexity ai'. The rule monitors for network connections to the malicious domain and the presence of extension-related file artifacts on the system. The extension utilizes chrome_settings_overrides to redirect browser Omnibox queries and exfiltrate user search activity to attacker-controlled infrastructure.
Microsoft Sentinel (KQL)
