Malicious 'PDF Viewer' extension sideloaded with combined dangerous permissions
Detects sideload installation of the malicious 'PDF Viewer' browser extension used by Jewelbug, identified by manifest content requesting cookies, debugger, native-messaging, and all-site scripting permissions together from a non-Web-Store install path.
Microsoft Sentinel (KQL)
