Rare Web Browser Extension Installation

F S@Fsdr

•updated Aug 13, 2026•19•1•21

This rule identifies rare web browser extensions installed on Chrome or Edge browsers by monitoring file events for low-prevalence extension IDs. An extension is considered rare if it has been observed on fewer than 3 devices within the last 30 days. This pattern is often used to detect malicious or unauthorized extensions, which can be leveraged for persistence or credential theft.