topic XQL query for searching extensions installed within an application in Cortex XDR Discussions

XQL query for searching extensions installed within an application

ShubhamT281 — Mon, 17 Jun 2024 12:52:34 GMT

Hi All,

Looking for an XQL query to detect extensions installed from an applications marketplace to use within the application. For eg. someone installing "github actions" extension from the azure marketplace.

Re: XQL query for searching extensions installed within an application

jmazzeo — Wed, 19 Jun 2024 13:45:22 GMT

Hi @ShubhamT281, thanks for reaching us using the Live Community.

That could be possible if the application creates a file in disk when a new application/plugin is installed. For example in Chrome, when an extension is installed a file is created on a specific folder.

Then an XQL Query looking for the .exe process with a file creation on the folder, like this:

| filter event_type = ENUM.FILE and event_sub_type = ENUM.FILE_CREATE_NEW

| filter actor_process_image_name = "app.exe"

If this post answers your question, please mark it as the solution.

Re: XQL query for searching extensions installed within an application

ShubhamT281 — Mon, 24 Jun 2024 11:10:43 GMT

Hi @jmazzeo

Unfortunately this is not the case with the extension that I am looking to search for, the extension is downloaded from the marketplace of the application and hence is not something browser related.

Is it possible to detect that via XDR ?