Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
191 detections
Filters
Last updated
All Time
Detection languages
100
42
13
13
10
Contributors
73
24
18
13
12
Categories
81
50
45
33
28
Platforms
182
47
43
4
4
Products / Services
94
46
12
10
8
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
IDS Classtypes
2
IDS Protocols
2
1
Detects indicators of a specific malicious browser extension, including file-system artifacts (extension directory placement), registry-based persistence mechanisms, and network communication to associated command-and-control (C2) or onboarding domains. The rule specifically monitors for known malicious identifiers related to a typosquatted domain campaign impacting popular web browsers.
This rule detects the presence or installation of a specific malicious Chromium-based browser extension (ID: flkebkiofojicogddingbdmcmkpbplcd). This extension masquerades as a 'Search for perplexity ai' utility but is designed to hijack browser search queries by redirecting them to a typosquatted domain ('perplexity-ai.online') using declarativeNetRequest rules.
Detects when a non-Discord process creates or modifies both 'index.js' and 'package.json' within a Discord desktop core module directory. This file pair is critical for Electron module loading and is often targeted by malware like VVS Stealer to establish persistent session interception.
Detects network connections from the 'Adblock for YouTube' browser extension to its remote API endpoint (api.adblock-for-youtube.com). These connections are associated with fetching 'scripletsRules', a post-installation mechanism used to deliver dynamic payloads and potentially bypass extension security reviews.
Detects the BadBlocker Adblock for YouTube extension (cmedhionkhpnakcndndgjdbohmhepckk) leveraging chrome.scripting.executeScript to inject server-fetched JavaScript into the MAIN world of web pages, specifically utilizing the 'trusted-create-element' scriptlet to facilitate this behavior.
Detects HTTP requests initiated by common browser adblock extensions to remote API endpoints for retrieving rule configuration files. This behavior can be exploited by adversaries to perform remote scriptlet injection or change extension behavior via server-side updates, potentially enabling unauthorized JavaScript execution in the browser's context.
Detects browser process command line arguments indicating the execution of malicious adblock extensions. The detection identifies these extensions by their known Chrome Extension IDs, observation of requests to specific command-and-control API endpoints, and attempts to execute JavaScript in the MAIN browser world to access sensitive session cookies via document.cookie, cookieStore.getAll, or chrome.cookies.getAll.
Detects Chrome extension package files associated with the 'BadBlocker' Adblock for YouTube campaign, identifying malicious indicators such as specific remote fetch logic ('scripletsRules'), Unistream SDK integration, and execution patterns that abuse browser extension functionality to bypass security controls or fetch remote content.
Detects network connections from browser processes (Chrome, Edge, Brave) to 'api.adblock-for-youtube.com'. This activity is linked to the retrieval of remote configuration scripts that can deliver malicious payloads, enabling arbitrary JavaScript execution within the context of visited web pages without requiring an official browser store update.
Detects the presence of known malicious browser extensions by their extension ID or extensions that declare overly permissive host access ('<all_urls>') in combination with suspicious naming conventions associated with common ad-blocking malware.
This rule detects network activity associated with known malicious browser extensions identified as 'AdBlock' variants. It monitors for connections to the domain 'api.adblock-for-youtube.com' or requests to '/api/v2/rules' made by specific extension IDs that are known to perform unauthorized or suspicious activities.
Detects the installation of known-malicious browser extensions followed by network communication from the browser process to associated Command and Control (C2) domains within a one-hour window. This behavior is indicative of malicious browser-based activity such as ad-fraud or credential theft.
Detects background JavaScript workers injecting helper files to ensure the extension remains active. This rule specifically looks for the creation of files named 'helper.html', 'dream.html', or 'dream.js' within the Microsoft Edge extension data folder, which is indicative of the SNOWBELT malware's persistence mechanism.
This rule detects suspicious modifications to Chrome browser extensions by monitoring registry events. Specifically, it looks for changes within the 'Chrome\Extensions' registry key where the 'chrome_settings_overrides' value name is set and its data contains the string 'search'. This pattern is indicative of an extension attempting to hijack browser search settings, often a tactic used by unwanted programs or malware to redirect user searches to malicious or ad-filled sites.
This rule detects suspicious modifications to Chrome browser extensions by monitoring registry events. Specifically, it looks for changes within the 'Chrome\Extensions' registry key where the 'chrome_settings_overrides' value name is set and its data contains the string 'search'. This pattern is indicative of an extension attempting to hijack browser search settings, often a tactic used by unwanted programs or malware to redirect user searches to malicious or ad-filled sites.
This rule detects suspicious activity related to browser extension installations by monitoring registry modifications. Specifically, it looks for multiple registry value sets within Chrome or Firefox extension paths within a short timeframe (1 hour), which could indicate an automated or malicious installation of browser extensions.
This rule detects the download of a potentially malicious browser extension in CRX format. It specifically looks for HTTP responses containing ".crx" in the URI and the string "CrOD" within the first 4 bytes of the file data, indicating a Chrome extension download. This could be an attempt to install a malicious extension for persistence or other adversarial activities.
Monitors for network connections originating from the VSCode extension host process to GitHub API endpoints immediately following a new extension installation. This may indicate token exfiltration or repository enumeration from a malicious extension.
Enumerates installed Chrome extensions, cross-references against public blocklists, and flags suspicious permissions.
This rule detects suspicious activity related to browser extension installations by monitoring registry modifications. Specifically, it looks for multiple registry value sets within Chrome or Firefox extension paths within a short timeframe (1 hour), which could indicate an automated or malicious installation of browser extensions.
Detects installation or update of a VSCode extension from an unapproved publisher by monitoring for vsce-sign.exe signature verification events in DeviceProcessEvents. VSCode invokes vsce-sign.exe once per extension install or auto-update to verify the extension's marketplace signature before extraction. The full extension slug is passed as the --package argument, making this a reliable, install-time signal that fires for all extension types regardless of whether the extension has a background process or language server.
Extensions are evaluated against an approved publisher list maintained as an embedded datatable. Publishers are matched on the prefix before the first . in the extension slug (e.g., ms-python from ms-python.python), allowing publisher-level approval rather than per-extension management.
This detection was developed in response to the TeamPCP supply chain campaign (May 2026), in which malicious VSCode extensions were distributed via fake GitHub issue notifications targeting developers.
Extensions are evaluated against an approved publisher list maintained as an embedded datatable. Publishers are matched on the prefix before the first . in the extension slug (e.g., ms-python from ms-python.python), allowing publisher-level approval rather than per-extension management.
This detection was developed in response to the TeamPCP supply chain campaign (May 2026), in which malicious VSCode extensions were distributed via fake GitHub issue notifications targeting developers.
Page 7 of 10