Search hijack via chrome_settings_overrides pointing to perplexity-ai.online
This rule monitors for the presence of a specific malicious browser extension (by identifier) on the file system and simultaneously tracks outbound network connections to a known typosquatted domain ('perplexity-ai.online'). It alerts on the potential presence of an adversary-controlled browser plugin or user navigation to a malicious domain often used in phishing or credential harvesting campaigns.
Microsoft Sentinel (KQL)
