Rare Chrome/Edge/Brave extension install or --load-extension sideload
Detects rare browser extensions installed on a low number of devices via direct file creation/modification within browser extension directories or through command-line sideloading using the --load-extension flag.
Microsoft Sentinel (KQL)
