Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
191 detections
Filters
Last updated
All Time
Detection languages
100
42
13
13
10
Contributors
73
24
18
13
12
Categories
81
50
45
33
28
Platforms
182
47
43
4
4
Products / Services
94
46
12
10
8
MITRE Techniques
18,123
15,646
12,594
8,402
6,230
IDS Classtypes
2
IDS Protocols
2
1
Detects the installation or presence of the GemStone browser extension backdoor. The detection logic identifies the malicious extension by flagging specific service worker file names ('background.js') located in browser extension directories, or by detecting browser extension events associated with unique indicators found in the 'AdditionalFields' metadata, specifically looking for keys such as 'kc_state', 'portal_sync_config', or a 'background.js' file reference.
This rule identifies browser extensions installed on devices that are either explicitly known as malicious or exhibit suspicious naming patterns potentially associated with unauthorized or malicious extensions.
This rule identifies browser extensions installed on devices that are either explicitly known as malicious or exhibit suspicious naming patterns potentially associated with unauthorized or malicious extensions.
This rule detects the installation of browser extensions that occur during an idle user session (greater than 7 minutes). This behavior is consistent with automated, remote-driven synthetic input injection, often utilized by malware (e.g., NinjaMare) to install malicious extensions without user consent while the system is unattended.
This rule detects the installation of browser extensions that occur during an idle user session (greater than 7 minutes). This behavior is consistent with automated, remote-driven synthetic input injection, often utilized by malware (e.g., NinjaMare) to install malicious extensions without user consent while the system is unattended.
Detects network traffic associated with the GemStone malicious browser extension, including initial registration to a command-and-control (C2) server on Cloudflare Workers, periodic heartbeat beacons, command polling, and external public IP address lookups for victim identification.
This rule detects the installation of browser extensions that occur during an idle user session (greater than 7 minutes). This behavior is consistent with automated, remote-driven synthetic input injection, often utilized by malware (e.g., NinjaMare) to install malicious extensions without user consent while the system is unattended.
This rule detects installation, file activity, or registry configuration changes associated with the 'bright-save-feed@tabtools.org' browser extension identifier. Such identifiers are commonly associated with malicious browser add-ons or potentially unwanted programs (PUPs) that may be used for browser session hijacking, unauthorized content injection, or persistent access.
Detects the installation of a Manifest V3 browser extension that requests the 'chrome.proxy' permission as its sole permission. This behavior is indicative of potential malicious extensions designed to modify web traffic or route browser activity through an adversary-controlled proxy server.
Detects creation of a new Microsoft Edge browser profile with a non-default, non-standard-numbered name, followed within 5 minutes by creation of files/folders containing "extension" or "native" under that profile's User Data path — consistent with the Edgecution malicious Edge extension backdoor installation flow.
Detects a sequence where a host performs process enumeration for EDR/AV security tools (CrowdStrike, Sophos) followed within 5 minutes by the execution of Microsoft Edge with specific flags (--headless=new or --no-startup-window, --load-extension, --disable-sync). This pattern is consistent with the UNC6692 'Edgecution' malware tradecraft used to check for security presence before sideloading a malicious browser extension.
Detects Google Chrome launched with Chrome DevTools Protocol (CDP) remote-debugging flags on the fixed port 18907 used by XCSSET's persistence/browser-hijacking component, excluding known browser-automation tooling.
This rule detects the extraction of a specific Python 3.13.3 embedded runtime archive ('python-3.13.3-embed-amd64-with-pip.zip') using tar.exe with a passphrase, targeted specifically at the Microsoft Edge User Data directory. The execution is flagged when initiated by processes like AutoHotkey or processes originating from within the Edge User Data directory, which is indicative of the 'Edgecution' malware suite's method for establishing a persistent native messaging host to facilitate malicious browser-based activity.
Detects the execution of Chromium-based browsers (Chrome, Edge, Brave, Chromium) using command-line arguments '--load-extension' or '--disable-extensions-except'. These flags are typically used for development purposes but are abused by attackers to sideload malicious, unpacked extensions, bypassing the browser's extension store review process and enabling techniques such as credential theft or C2 persistence.
Detects network, process, and file activity referencing the specific hard-coded VAPID public key used by SNOWBELT in the UNC6692/Edgecution campaign for push-notification-based registration, correlating browser extension file drops (background.js, extension.log) with the key's appearance in network traffic or process command lines.
Detects the execution of Microsoft Edge (msedge.exe) with suspicious command-line arguments designed to sideload malicious browser extensions, often associated with the UNC6692 campaign. The rule specifically looks for a combination of flags including --load-extension, headless/no-startup-window modes, known malicious or suspicious paths (e.g., 'User Data\test1'), and the disabling of browser synchronization or the first-run experience, occasionally triggered by scheduled tasks.
Detects Google Chrome launched with Chrome DevTools Protocol (CDP) remote-debugging flags on the fixed port 18907 used by XCSSET's persistence/browser-hijacking component, excluding known browser-automation tooling.
This rule detects when common web browser processes spawn command-line shells or scripting interpreters. This behavior is often indicative of malicious browser extensions, browser exploitation, or remote code execution attempts, as browsers generally should not be launching native system shells.
Detects instances where Microsoft Edge (msedge.exe) initiates a python.exe process that executes 'native_host.py' (associated with the Edgecution malware suite) and subsequently writes files to sensitive or non-standard directories such as ProgramData or Edge recovery folders. This activity is indicative of the malware's native messaging host persistence, staging, or data exfiltration mechanisms.
Detects malicious browser extension background scripts exfiltrating browser data by identifying specific message patterns (type 0x14/20 and event 0xc8/200 containing keyword, url, and count fields) or activity associated with known malicious extension IDs and native messaging hosts.
Detects HollowMare variants (OneZip/CrystalPDF/PowerDoc) that terminate a running Chrome or Firefox process immediately before overwriting a browser profile configuration file (Preferences, Secure Preferences, prefs.js) with a C2-supplied version to hijack the default search engine.
Page 3 of 10