StegoAd Malicious Edge Extension IDs Written to Extension Directory

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

This rule detects the creation of files or directories associated with known suspicious or malicious browser extension IDs within the Microsoft Edge User Data folder. It monitors for the writing of new executables, scripts, or directory creation events that match specific, potentially malicious extension GUIDs.