Malicious 'Search for perplexity ai' extension keystroke exfil via suggest_url to perplexity-ai.online
This rule detects suspicious activity involving interaction with the 'perplexity-ai.online' domain and the creation of specific browser extension files, which may indicate browser-based data exfiltration or credential theft. The rule correlates file creation events, DNS queries, and network connections, assigning a higher risk score when multiple indicators are present, particularly when evidence suggests exfiltration of keystroke or search data via web requests.
Splunk (SPL)
