KREMLIN malicious browser extension sideloaded into Chrome/Edge
This rule detects two distinct malicious activities: 1) The presence or execution of files with specific SHA1/SHA256 hashes known to be malicious, identified across file creation, process execution, or as initiating processes. 2) The forced installation of browser extensions in Google Chrome or Microsoft Edge by identifying modifications to the 'ExtensionInstallForcelist' registry key.
Microsoft Sentinel (KQL)
