Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
191 detections
Filters
Last updated
All Time
Detection languages
100
42
13
13
10
Contributors
73
24
18
13
12
Categories
81
50
45
33
28
Platforms
182
47
43
4
4
Products / Services
94
46
12
10
8
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
2
IDS Protocols
2
1
Detects Edgecution/SNOW malware suite components across the kill chain via known SHA256 file hashes (phishing HTML, AutoHotkey stager, Edgecution ZIP archive, extension background.js, Python native host backdoor) and combinations of embedded code/path strings associated with SNOWGLAZE/SNOWBASIN; requires multiple distinctive strings together to reduce false positives
Detects creation of Chromium/Edge NativeMessagingHosts registry keys or supporting files (native_host.py, *.api.json) pointing to non-Program Files locations such as AppData, Temp, or ProgramData, consistent with the Edgecution malicious edge extension backdoor's native messaging host persistence mechanism used by UNC6692 to enable extension-to-native-process IPC.
This rule detects the installation of browser extensions that request host permissions for major AI services (Claude, ChatGPT, Gemini, Copilot). It filters out pre-approved extension IDs to highlight potentially unauthorized or malicious extensions that may be used to intercept sensitive user interactions, prompts, or AI-generated data.
This rule detects file-level activity associated with the known malicious version of the ModHeader browser extension (Extension ID: idgpnmonknjnojddfkpgkljpfnnfcklj). It flags the presence of specific indexedDB LevelDB files and temporary directories that are characteristic of the malicious update, which was used for unauthorized data access and browser-based persistence.
Detects file system artifacts indicating installation of the malicious 'ascii-fetcher' VS Code extension (v1.0.0) from the Open VSX marketplace, which bundles the malicious npm dependency '@jaymara/jsononifier' to hide its logic from static analysis.
Detects the presence of file system artifacts associated with the malicious Chromium extension 'Search for perplexity ai' (extension ID: flkebkiofojicogddingbdmcmkpbplcd) on an endpoint. This extension is known to perform search hijacking and keystroke exfiltration.
Detects browser search traffic being hijacked to the typosquatted domain 'perplexity-ai.online' by the malicious Chromium extension 'Search for perplexity ai'. The rule monitors for network connections to the malicious domain and the presence of extension-related file artifacts on the system. The extension utilizes chrome_settings_overrides to redirect browser Omnibox queries and exfiltrate user search activity to attacker-controlled infrastructure.
Detects artifacts and network activity associated with a malicious Chromium extension (ID: flkebkiofojicogddingbdmcmkpbplcd) that uses declarativeNetRequest rules to redirect browser search traffic to a typosquatted domain (perplexity-ai.online). The rule correlates file creation, registry modifications, and outbound network connections to the malicious domain from common web browsers.
Detects the presence of malicious Chromium browser extension artifacts related to the 'Search for perplexity ai' extension. This extension abuses Manifest V3 declarativeNetRequest permissions (such as declarativeNetRequestFeedback and declarativeNetRequestWithHostAccess) to intercept and redirect network requests to the attacker-controlled domain 'perplexity-ai.online'. The rule specifically identifies the extension's rule resource files (e.g., perplexity-rules.json) and specific file paths associated with the extension ID.
This rule detects instances where Microsoft Edge or Google Chrome are launched with the --load-extension command line argument pointing to non-standard or suspicious directories (such as Temp, Downloads, or ProgramData). These locations are often used by malicious extensions to evade detection. The rule also flags instances where these browsers are launched by suspicious parent processes, which may indicate automated installation or control by malicious actors.
This rule detects the presence of a known malicious Chromium extension (ID: flkebkiofojicogddingbdmcmkpbplcd) that hijacks browser search functionality. The detection monitors for three distinct indicators: the creation of specific extension files within the Chromium directory, network communication with attacker-controlled domains (perplexity-ai.online, extension.tilda.ws), and registry modifications that override default search settings.
Detects Microsoft Edge or Google Chrome spawning suspicious shell processes (cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe), which is characteristic of the StegoAd browser extension campaign. The rule specifically flags browser processes launching script interpreters with command-line arguments containing obfuscated content (e.g., base64, eval) or references to specific image files (e.g., loading.webp, .woff2) used for steganographic payload delivery.
Detects the presence of file system artifacts associated with a malicious Chrome extension (ID: flkebkiofojicogddingbdmcmkpbplcd) that masquerades as a 'Perplexity AI' search tool. This extension is known to hijack browser search queries by redirecting them through the typosquatted domain 'perplexity-ai.online'.
This rule detects potentially malicious activity related to browser extensions, specifically targeting configuration file modifications (manifest.json, rules files) or the use of sensitive browser APIs (declarativeNetRequest, updateDynamicRules) that are commonly abused by malicious extensions. It also flags activity that includes keywords associated with affiliate/ad-click fraud platforms within command line arguments of major browsers like Chrome and Edge.
Detects the presence of the malicious Chromium extension 'Search for perplexity ai' (ID flkebkiofojicogddingbdmcmkpbplcd) on disk. This extension hijacks browser default search settings to redirect queries through the typosquatted domain perplexity-ai[.]online.
Detects the presence of a known malicious Chromium extension (ID: flkebkiofojicogddingbdmcmkpbplcd) that masquerades as a legitimate 'Perplexity AI' extension. This malware hijacks the browser's default search provider to redirect traffic to 'perplexity-ai.online'.
This rule monitors for file and process events associated with known malicious Chrome extensions. It filters for specific extension IDs embedded within file paths or command-line strings, which typically indicate the installation or activity of malicious browser plugins.
Detects the presence of the malicious Chrome extension with ID 'flkebkiofojicogddingbdmcmkpbplcd' on an endpoint. This extension is known to hijack the browser's default search provider, redirecting queries to an attacker-controlled domain, and includes manifest configurations that may facilitate future WebAssembly-based malicious execution.
Detects network requests to a typosquatted domain 'perplexity-ai.online' initiated by a malicious browser extension. The extension uses the 'suggest_url' feature to exfiltrate keystrokes typed into the browser omnibox in real-time, effectively performing browser-based keylogging.
This rule detects suspicious activity related to browser extension installations by monitoring registry modifications. Specifically, it looks for multiple registry value sets within Chrome or Firefox extension paths within a short timeframe (1 hour), which could indicate an automated or malicious installation of browser extensions.
Detects high-volume, rapid outbound network requests from Opera or Opera GX browser processes, characteristic of CSS attribute-selector trigram enumeration used in XS-Leak attacks to exfiltrate sensitive information from loaded web pages.
Page 4 of 10