Native-messaging host com.lunex.explorer file drop (Psychedelic Stealer)
This rule detects the creation or modification of browser native messaging host configuration files (e.g., com.lunex.explorer.json) combined with the simultaneous or subsequent termination of common web browsers. This pattern is indicative of potential browser hijacking, where an adversary sets up a malicious native messaging host to facilitate persistence or intercept browser communications and subsequently restarts or terminates the browser process to reload the configuration.
Microsoft Sentinel (KQL)
