Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

KQL to detect new chromium browser extension installation on MDE endpoints by Emerald Sleet (APT43)

Steven Lim@KQLWizard

•updated Jul 1, 2025•10•0•63

KQL Query

Microsoft Sentinel (KQL)

Tags

T1071.001 - Web Protocols T1036.005 - Match Legitimate Resource Name or Location T1204.002 - Malicious File TA0011 - Command and Control TA0005 - Defense Evasion TA0002 - Execution T1566.001 - Spearphishing Attachment T1189 - Drive-by Compromise T1559.002 - Dynamic Data Exchange T1574.008 - Path Interception by Search Order Hijacking T1059 - Command and Scripting Interpreter T1566 - Phishing T1559 - Inter-Process Communication T1574 - Hijack Execution Flow TA0001 - Initial Access TA0003 - Persistence TA0004 - Privilege Escalation File Creation File Download Windows Windows Defender Atpkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?