-
Browser Extension Install
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Persistence Data Source: Elastic Defend Data Source: Elastic Endgame Data Source: SentinelOne Data Source: Sysmon Data Source: Microsoft Defender XDR Resources: Investigation Guide Noise: Low Performance: Normal Threat: Browser Extension Abuse Rule Type: Event Correlation (EQL) Platform: Windows ·Identifies the install of browser extensions. Malicious browser extensions can be installed via app store downloads masquerading as legitimate extensions, social engineering, or by an adversary that has already compromised a system.
Read More -
Manual Loading of a Suspicious Chromium Extension
Sep 19, 2026 · Domain: Endpoint OS: macOS Use Case: Threat Detection Tactic: Persistence Tactic: Credential Access Data Source: Elastic Defend Resources: Investigation Guide Noise: Low Performance: Normal Profile: Recommended Threat: Browser Extension Abuse Rule Type: Event Correlation (EQL) Platform: macOS ·Detects the manual loading of a Chromium-based browser extension via command line arguments. This activity is suspicious and could indicate a threat actor loading a malicious extension to persist or collect browsing secrets such as cookies and authentication tokens.
Read More