Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
191 detections
Filters
Last updated
All Time
Detection languages
100
42
13
13
10
Contributors
73
24
18
13
12
Categories
81
50
45
33
28
Platforms
182
47
43
4
4
Products / Services
94
46
12
10
8
MITRE Techniques
18,123
15,646
12,594
8,402
6,230
IDS Classtypes
2
IDS Protocols
2
1
Detects the installation of browser extensions, primarily cryptocurrency wallets, that are known targets for the Stealit information stealer.
Detects code.exe launching Node to perform unauthorized background activities, specifically tied to compromised extension folders like quartz-markdown-editor or oorzc.
Detects the installation of specific Chrome browser extensions associated with the 'BadBlocker' campaign. These extensions are known to request broad host permissions, allowing them to access data across all websites, which can lead to sensitive information theft, credential harvesting, or session hijacking.
This rule monitors and alerts on network connections originating from hosts to known command-and-control (C2) or infrastructure domains associated with malicious browser extensions, specifically those identified in the BadBlocker campaign. These extensions often masquerade as legitimate ad-blocking tools to perform lifecycle beaconing or redirect users to promotional/malicious content.
Detects network, process, or command-line activity associated with the installation or update of malicious Chrome extensions linked to the BadBlocker campaign. The rule specifically monitors for known extension IDs: cmedhionkhpnakcndndgjdbohmhepckk (Adblock for YouTube), onomjaelhagjjojbkcafidnepbfkpnee (Adblock for Chrome), gekoepiplklhniacchbbgbhilidiojmb (AdBlock Suite), and ogcaehilgakehloljjmajoempaflmdci (Adblock for You).
Detects the presence or installation of known malicious Adblock for YouTube browser extensions. These extensions are flagged for utilizing overly broad host permissions (e.g., <all_urls>) in conjunction with webRequest and scripting capabilities, which facilitates cross-site data collection, potential session hijacking, and the injection of malicious remote scripts.
Detects network activity associated with the 'Adblock for YouTube' Chrome extension (ID: cmedhionkhpnakcndndgjdbohmhepckk) as it retrieves malicious scripts from 'api.adblock-for-youtube.com'. These scripts are designed to access sensitive browser data, including session cookies, localStorage, and sessionStorage, and potentially interact with site-specific login form elements within the user's browser session.
This rule detects activity associated with malicious or intrusive browser extensions, specifically identifying network connections to a known malicious command-and-control (C2) endpoint, execution of specific scriptlet keywords related to MAIN-world injection in browser processes, and the presence of known 'BadBlocker' extension IDs on endpoints.
Detects evidence of a malicious browser extension, identified by extension ID flkebkiofojicogddingbdmcmkpbplcd, designed to redirect search traffic through a typosquatted domain 'perplexity-ai.online'. The rule monitors for file-system creation of the malicious extension, modifications to browser preferences files, manipulation of system registry keys to enforce the search provider, and outbound network connections to the malicious domain from major web browsers.
Detects modifications or creations of manifest.json files within specific directories associated with a browser extension. This behavior is often indicative of the installation or tampering of browser extensions by malicious actors to establish persistence, perform credential theft, or execute unauthorized actions within the browser context.
Detects the presence of a known malicious Chrome extension (ID: flkebkiofojicogddingbdmcmkpbplcd) or its associated files (e.g., rules.json, background.js) within browser extension storage directories on managed Windows endpoints. This rule monitors for file activity related to browser extensions that may have been deployed via malicious means to steal credentials or establish persistence.
This rule detects the installation and activity of a malicious Google Chrome extension used to hijack the browser's default search provider. The rule triggers on a multi-stage process involving the creation of a specific malicious extension directory, modification of the Chrome Preferences file to change search settings, tampering with the 'PreferenceMACs' registry keys to bypass browser-based integrity warnings, and subsequent network communication with a known malicious C2 domain associated with the search hijack.
Detects the installation of a malicious Chrome extension (identified by its extension ID) that abuses declarativeNetRequest permissions to intercept and redirect user search queries through the 'perplexity-ai.online' domain. The detection correlates the creation of the extension's directory on disk with a high volume of network connections from the browser to the malicious intermediary domain.
Detects a malicious browser extension (ID: flkebkiofojicogddingbdmcmkpbplcd) that masquerades as Perplexity AI. The rule identifies the extension installation followed by a two-hop network redirect sequence: the browser is first directed to a malicious domain (perplexity-ai.online) which logs user metadata, then immediately redirected to a ZIP file download lure on a different domain. This behavior is correlated within a 30-minute window for a specific browser process.
Identifies command prompts spawning headless Microsoft Edge with user data directories redirected and forced extension loading. This behavior is often associated with malware attempting to load malicious browser extensions or exfiltrate data without a visible browser window.
Identifies the Potentially Unwanted Program (PUP) forcibly modifying Chrome or Edge extension directories or registry preferences to inject malicious stealers. This rule specifically looks for file creation or modification events within browser extension folders, initiated by common installer/updater executable names.
This rule detects indicators associated with the StegoAd malware family, specifically focusing on suspicious browser extension IDs observed in command-line arguments and network-related process activity (ProcessCreate or NetworkConnect). It monitors for known extension identifiers, StegoAd-specific C2 infrastructure domains, and payload frameworks observed in process command lines.
Detects browser processes invoking internal extension schemes and subsequently generating high volumes of network requests to e-commerce or advertising-related domains/URLs, indicating potentially malicious browser extension behavior such as affiliate tag substitution or ad-injection.
This rule detects installation artifacts, configuration file modifications, registry changes, and network activity associated with a specific malicious Chromium extension ('flkebkiofojicogddingbdmcmkpbplcd') that hijacks the default browser search provider via declarativeNetRequest rules and communicates with a typosquatted domain 'perplexity-ai.online'.
Detects artifacts and behaviors associated with a malicious Chromium extension identified as 'Search for perplexity ai' (extension ID: flkebkiofojicogddingbdmcmkpbplcd). The rule monitors for unauthorized extension installation, registry modifications to the browser's default search provider settings pointing to a suspicious domain (perplexity-ai.online), and outbound browser network traffic or DNS queries directed toward the same domain for potential data exfiltration.
Detects outbound network traffic from common web browsers (Chrome, Edge, Brave, etc.) to the typosquatted domain 'perplexity-ai.online'. This rule identifies behavior associated with a malicious browser extension ('Search for perplexity ai') that exfiltrates keystrokes and search queries captured via the browser's Omnibox functionality to an attacker-controlled server.
Page 6 of 10