Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
160 detections
Filters
Last updated
All Time
Detection languages
89
19
14
12
11
Contributors
42
32
15
11
5
Categories
52
45
32
25
23
Platforms
148
48
45
4
4
Products / Services
72
26
15
9
8
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
2
Detects malicious browser extensions associated with the DarkSpectre 'Zoom Stealer' campaign by identifying known malicious extension IDs. The campaign uses these extensions for corporate espionage by stealing meeting intelligence from various video conferencing platforms.
This rule detects the creation of files with specific malicious extension IDs on devices. These extensions are typically associated with browser-based malware or unwanted programs that modify browser behavior, steal data, or perform other malicious activities. The rule specifically looks for `FileCreated` events where the `FileName` matches any of the predefined malicious extension IDs.
This rule detects the presence of known malicious browser extensions on devices. It identifies extensions based on a curated list of Extension IDs associated with various threats, including Urban VPN, extensions that turned malicious, general malicious browser extensions, and those involved in Chrome extension supply chain attacks. The rule queries `DeviceTvmBrowserExtensions` to find any activated extensions matching these IDs.
This rule detects the presence of known malicious browser extensions, specifically Urban VPN, Urban Browser Guard, Urban Ad Blocker, and 1ClickVPN Proxy, across Chrome and Edge browsers. It identifies these extensions by searching for their unique 32-character Extension IDs within file paths or file names associated with device file events. The rule then enriches the findings with the extension's name and the browser it belongs to.
Detects PNG files containing a steganographic marker ('===') used by the GhostPoster malware campaign to hide a JavaScript payload. This technique was observed in malicious Firefox browser extensions.
Detects a Chromium based browser process with the 'load-extension' flag to start a instance with a custom extension
Detects a suspicious process spawning a Chromium based browser process with the 'load-extension' flag to start an instance with a custom extension
This query is oriented to identify and classify browser extensions by group and risk severity based on a well-known list of browser extension.
This rule detects the creation of executable files (.exe, .dll, .pyd) within browser extension folders (Chrome, Edge, Firefox) followed by a related registry modification within a one-hour window. This behavior is indicative of malicious browser extension installation or modification, often used for persistence or data exfiltration.
This rule detects the modification of the Windows Registry to install or configure Chrome VPN extensions. Specifically, it looks for changes to the 'Software\Wow6432Node\Google\Chrome\Extensions' registry path where the 'update_url' value is set for a known list of VPN extension IDs. This method can be used by adversaries to establish persistence or gain initial access by forcing the installation of malicious or controlled VPN extensions.
Detects the installation of browser extensions, primarily cryptocurrency wallets, that are known targets for the Stealit information stealer.
This rule detects potential persistence mechanisms related to browser extensions. It looks for processes launching Chrome or Edge with the '--load-extension' command-line argument, which can be used to load unpacked extensions. Additionally, it monitors registry modifications to 'ExtensionInstallForcelist' that contain 'http' or 'crx', indicating a forced installation of an extension, potentially from a remote source or a local file.
Detects potential unauthorized browser extension installations or debugging activities by monitoring process and network events related to popular web browsers.
This Logic detects the presence of the malicious Chrome extension FreeVPN.One by identifying its unique extension ID across installed browsers. The logic further correlates this presence with network communications initiated by the extension to suspicious or untrusted domains. By combining extension enumeration with traffic analysis, the detection ensures high fidelity with minimal false positives. This layered approach strengthens visibility into malicious browser add-ons masquerading as VPN tools.
Detects a Chromium-based browser process being launched with the '--load-extension=' command-line flag. This flag allows an instance of the browser to be started with a custom extension, which can be abused by adversaries for persistence, data exfiltration, or other malicious activities. This technique is often associated with malware like ChromeLoader.
Detects a suspicious process spawning a Chromium-based browser process with the '--load-extension' flag to start an instance with a custom extension. This technique is often used by adversaries to establish persistence or execute malicious code within the browser environment.
This query identifies browser extensions with a low global prevalence, which could indicate a malicious or unwanted extension. It specifically looks for .crx files created in "Webstore Downloads" folders and enriches the data with file prevalence information.
Scan for 18 malicious extensions
This detection looks for activity associated with the Redirection ad-jacking campaign. It detects network connections to known malicious C2 domains and the installation of malicious browser extensions identified by their extension IDs.
KQL Query from file: Global Admin Entra Cookie with Chrome ZeroDay
KQL Query from file: Detecting New Copilot Extensions
Page 7 of 8