Malicious Browser Extension Sideload (Fake Google Translate-style)

Ankit Mehta@Secvyn

•updated Aug 10, 2026•6•0•6

This rule detects the creation or modification of files within the Google Chrome browser extensions directory by processes other than legitimate Chrome-related binaries (chrome.exe, GoogleUpdate.exe). This activity is highly indicative of malicious browser extension sideloading or persistence, where an adversary attempts to install a rogue extension to achieve goals such as credential theft, session hijacking, or command-and-control communication.