Malicious 'VPN Go: Free VPN' Chrome Extension Installation
This rule monitors DeviceFileEvents to detect the installation of a known malicious browser extension, 'VPN Go: Free VPN'. By matching file activity against the extension's unique ID, this detection helps identify potential browser-based threats, such as information stealer functionality or persistent backdoors installed via malicious extensions.
Microsoft Sentinel (KQL)
