FileFix Series — Most Significant TTP 2026: CrashFix Malicious Browser Extension Masquerading as Ad Blocker
Detects the creation of registry keys associated with the installation of Chrome or Edge browser extensions, specifically targeting the behavior exhibited by the CrashFix malware which masquerades as an ad blocker to achieve persistence.
Microsoft Sentinel (KQL)
