Browser-Extension

Summarize versions prior to 0.15.1 contain a vulnerability (CVE-2026-45245) in the hover summary feature that allows malicious pages to dispatch synthetic mouseover events, triggering authenticated daemon requests and potentially exposing sensitive internal endpoints.

This rule detects the installation of browser extensions, a persistence mechanism where attackers install malicious extensions via app store downloads, social engineering, or compromised systems, focusing on file creation events in extension directories on Windows.

This rule identifies the installation of potentially malicious browser extensions, which adversaries can leverage for persistence and unauthorized activity by monitoring file creation events in common browser extension directories on Windows systems.