Firefox Smart Window private URL exfiltration to attacker-controlled endpoint
Detects the exploitation or configuration manipulation of the Firefox browser.smartwindow.enabled feature, which can be abused by an attacker to exfiltrate sensitive browser data such as history, tab URLs, and secret query-string parameters to a remote endpoint. The rule monitors for network connections containing known exfiltration path signatures, connections to hardcoded PoC server addresses, or the modification of configuration settings related to the SmartWindow feature.
Microsoft Sentinel (KQL)
