Browser Extension Enumeration via DeviceFileEvents

id: ede058ab-97a8-4494-aa76-b7f5f6d78cba
name: Browser Extension Enumeration via DeviceFileEvents
description: |
  Identifies browser extension CRX files observed across endpoints. Helps in enumerating commonly installed extensions and hunting for potentially malicious ones.

  ---
  Optional Enrichment: 
  To enrich the `ExtensionId` values with extension names, ratings, and user counts, use the open-source script from:
  https://github.com/venkat117/browser-extension-scraper
severity: Medium
requiredDataConnectors:
  - connectorId: MicrosoftDefenderAdvancedThreatProtection
    dataTypes:
      - DeviceFileEvents
tactics:
  - Discovery
query: |
  DeviceFileEvents
  | where TimeGenerated >= ago(180d)
  | where FileName endswith ".crx"
  | extend ExtensionId = tolower(split(FileName, "_")[0])
  | where ExtensionId matches regex @"^[a-p]{32}$"
  | summarize DeviceCount = dcount(DeviceName) by ExtensionId
  | sort by DeviceCount desc
queryFrequency: P7D
queryPeriod: P180D
version: 1.0.0
kind: Hunting
tags:
  - ChromeExtensions
  - Endpoint
  - DeviceFileEvents
author:
  name: Venkata Reddy
  email: venkatareddy1173@gmail.com