Malicious Perplexity AI Chromium Extension — flkebkiofojicogddingbdmcmkpbplcd Install or C2
This rule detects activities associated with a specific malicious browser extension, including the presence of its files on disk, execution of browsers with the extension ID in the command line, and network connections to known malicious or typosquatted domains (perplexity-ai.online, extension.tilda.ws) used for C2 or exfiltration.
Splunk (SPL)
