T1176.001: Malicious ModHeader Extension (idgpnmonknjnojddfkpgkljpfnnfcklj) Files on Disk
This rule detects file-level activity associated with the known malicious version of the ModHeader browser extension (Extension ID: idgpnmonknjnojddfkpgkljpfnnfcklj). It flags the presence of specific indexedDB LevelDB files and temporary directories that are characteristic of the malicious update, which was used for unauthorized data access and browser-based persistence.
Microsoft Sentinel (KQL)
