Chrome VPN Extension Registry Modification
This rule detects the modification of the Windows Registry to install or configure Chrome VPN extensions. Specifically, it looks for changes to the 'Software\Wow6432Node\Google\Chrome\Extensions' registry path where the 'update_url' value is set for a known list of VPN extension IDs. This method can be used by adversaries to establish persistence or gain initial access by forcing the installation of malicious or controlled VPN extensions.
Sigma
