Browser Extension Forced Installation via Registry Policy
Detects unauthorized modifications to Windows Registry keys responsible for forcing browser extensions. Attackers often abuse 'ExtensionInstallForcelist' and related policy keys in Google Chrome, Microsoft Edge, or Brave to silently install malicious extensions for persistence or credential theft. This rule flags modifications performed by processes other than known system administration or GPO management tools.
Cortex XDR
