Suspicious Browser Extension Installation

Ankit Mehta@Secvyn

•updated Jun 30, 2026•6•0•3

This rule detects suspicious activity related to browser extension installations by monitoring registry modifications. Specifically, it looks for multiple registry value sets within Chrome or Firefox extension paths within a short timeframe (1 hour), which could indicate an automated or malicious installation of browser extensions.