Chrome Extension Installed via Group Policy / Registry Force-List Tampering

Ankit Mehta@Secvyn

•updated Aug 10, 2026•4•1•3

This rule detects unauthorized modifications to the Chrome 'ExtensionInstallForcelist' registry key. This key is used to force-install browser extensions. Adversaries often abuse this mechanism to persist malicious browser extensions without user interaction. The rule filters out known legitimate processes associated with policy updates such as gpupdate, mmc, and services.