BeepRAT/Perplexity Extension declarativeNetRequest Permission Abuse Detected
Detects the presence of a known malicious Chrome extension (ID: flkebkiofojicogddingbdmcmkpbplcd) or its associated files (e.g., rules.json, background.js) within browser extension storage directories on managed Windows endpoints. This rule monitors for file activity related to browser extensions that may have been deployed via malicious means to steal credentials or establish persistence.
Microsoft Sentinel (KQL)
