Query the installed extensions with the most required permissions

Query · kql

let ExtentionsWithNotification = DeviceTvmBrowserExtensionsKB
     | where PermissionId contains "Notification"
     | summarize make_set(ExtensionId) by ExtensionId;
DeviceTvmBrowserExtensions
| where ExtensionId in (ExtentionsWithNotification)
| distinct DeviceId, ExtensionName
| summarize TotalInstalledDevices = count() by ExtensionName
| sort by TotalInstalledDevices
Raw source Query the installed extensions with the most required permissions · KQL
Esc
Published by Bert-JanP/Hunting-Queries-Detection-Rules ↗, licensed under BSD 3-Clause ↗. Reproduced here unmodified. 
# Query the installed extensions with the most required permissions
----
## Defender XDR
```
let ExtentionsWithNotification = DeviceTvmBrowserExtensionsKB
     | where PermissionId contains "Notification"
     | summarize make_set(ExtensionId) by ExtensionId;
DeviceTvmBrowserExtensions
| where ExtensionId in (ExtentionsWithNotification)
| distinct DeviceId, ExtensionName
| summarize TotalInstalledDevices = count() by ExtensionName
| sort by TotalInstalledDevices
```

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.