Chrome Extension (CRX) - Malicious Extension Install Detection
Detects the creation of Chrome extension files (.crx) that match known malicious extension IDs. Malicious CRX files on endpoints can indicate an attacker dropped or installed a malicious extension (e.g., credential harvesters, redirectors, miners). The rule flags CRX creation with known bad IDs and requires available file hashes for further investigation.
Microsoft Sentinel (KQL)
