Default browser search engine hijack via injected registry modification

Arnold Chan@slaz

•updated Sep 4, 2026•0•0•1

This rule detects unauthorized modifications to browser search provider settings in the Windows Registry, targeting keys associated with Chrome and Microsoft Edge search configuration. This activity is often indicative of browser hijacking or search engine redirection campaigns, such as the NinjaMare malware.