StegoAd Extension Ad Injection and Affiliate Hijacking via Content Script
Detects browser processes invoking internal extension schemes and subsequently generating high volumes of network requests to e-commerce or advertising-related domains/URLs, indicating potentially malicious browser extension behavior such as affiliate tag substitution or ad-injection.
Splunk (SPL)
