Malicious 'Search for perplexity ai' Chromium Extension Installation
This rule detects the presence of a known malicious Chromium extension (ID: flkebkiofojicogddingbdmcmkpbplcd) that hijacks browser search functionality. The detection monitors for three distinct indicators: the creation of specific extension files within the Chromium directory, network communication with attacker-controlled domains (perplexity-ai.online, extension.tilda.ws), and registry modifications that override default search settings.
Microsoft Sentinel (KQL)
