Malicious Chrome Extension CRX Download

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•6

This rule detects the download of a Chrome extension file (.crx) from an HTTP server to a client. It specifically looks for the string ".crx" in the HTTP URI and the string "CrOD" within the first 4 bytes of the file data, which is a common magic number for Chrome extension files. This combination suggests a potential malicious Chrome extension download, often used for persistence or other malicious activities.