Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
191 detections
Filters
Last updated
All Time
Detection languages
100
42
13
13
10
Contributors
73
24
18
13
12
Categories
81
50
45
33
28
Platforms
182
47
43
4
4
Products / Services
94
46
12
10
8
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
2
IDS Protocols
2
1
Detects the installation of browser extensions, primarily cryptocurrency wallets, that are known targets for the Stealit information stealer.
This detection identifies the installation of known malicious Chrome extensions associated with the "Madgicx Plus" campaign, which targets Meta advertisers to steal credentials and hijack sessions. The rule looks for registry modifications that include the specific IDs of these malicious extensions.
This rule detects the presence of potentially malicious or unwanted browser extensions and outbound network connections to known adware or tracking domains. It correlates extension presence with network behavior to identify threats.
This query identifies browser extensions with a low global prevalence, which could indicate a malicious or unwanted extension. It specifically looks for .crx files created in "Webstore Downloads" folders and enriches the data with file prevalence information.
This rule detects suspicious file access patterns to Chromium-based browser extension data folders. Specifically, it looks for any process other than the browser itself (msedge.exe, chrome.exe, wavebrowser.exe, vivaldi.exe, brave.exe, brchrome.exe) reading or accessing files within the 'AppData\Local\User Data\Default\Extensions' directory. This activity could indicate an attempt by malware or an unauthorised process to inspect, modify, or exfiltrate data related to browser extensions, potentially for credential theft, session hijacking, or to inject malicious code into extensions.
Scan for 18 malicious extensions
KQL Query from file: Detecting New Copilot Extensions
KQL Query from file: Hunting Malicious Chrome Extension
KQL Query from file: Chrome extension stealth persistence detection
KQL Query from file: CVE-2024-7971 Patch Prioritization
KQL Query from file: M365 Copilot Extensions Threat Monitoring
KQL Query
KQL Query from file: Hunting chrome extension with hidden tracking
KQL Query from file: Cookie-Bite Detection
KQL Query from file: Hunting Malicious Chrome Extension
KQL Query from file: Hunting Malicious Chrome Extension
KQL Query from file: Hunting Malicious Chrome Extension
This query was originally published in the threat analytics report, ironSource PUA & unwanted apps impact millions.
IronSource provides software bundling tools for many popular legitimate apps, such as FileZilla. However, some of ironSource's bundling tools are considered PUA, because they exhibit potentially unwanted behavior. One component of these tools, detected by Microsoft as Prifou, silently transmits system information from the user. It also installs an outdated version of Chromium browser with various browser extensions, resets the user's home page, changes their search engine settings, and forces Chromium and itself to launch at startup.
The following query can be used to locate unique command-line strings used by ironSource bundlers to launch Prifou, as well as commands used by Prifou to install Chromium.
IronSource provides software bundling tools for many popular legitimate apps, such as FileZilla. However, some of ironSource's bundling tools are considered PUA, because they exhibit potentially unwanted behavior. One component of these tools, detected by Microsoft as Prifou, silently transmits system information from the user. It also installs an outdated version of Chromium browser with various browser extensions, resets the user's home page, changes their search engine settings, and forces Chromium and itself to launch at startup.
The following query can be used to locate unique command-line strings used by ironSource bundlers to launch Prifou, as well as commands used by Prifou to install Chromium.
Detects execution of ChromeLoader malware via a registered scheduled task
Detects a suspicious process spawning a Chromium based browser process with the 'load-extension' flag to start an instance with a custom extension
Detects a Chromium based browser process with the 'load-extension' flag to start a instance with a custom extension
Page 9 of 10