StegoAd Time-Gate Init - Browser Extension Registry Timestamp Write

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•2

Detects registry SetValue events targeting Chrome, Edge, or Chromium extension storage keys by processes not associated with official browser updaters or installers. This rule identifies the initialization phase of StegoAd malware (associated with the DarkSpectre campaign), where a first-run timestamp is written to the registry to establish a 3-5 day dormancy period before the extension activates its steganographic payload retrieval functionality.