Cortex XDR Pro / Browser extensions

CraigV123 — Wed, 18 Feb 2026 12:27:42 GMT

Has anyone ever configured their environment to detect on unauthorized or unsupported browser extensions? Or conduct a threat hunt based on known facts?

We've seen some slip through the cracks and I know Cortex doesn't natively detect abused or malicious extensions. Any XQL ideas out there perhaps?

Re: Cortex XDR Pro / Browser extensions

susekar — Wed, 18 Feb 2026 13:58:25 GMT

Hello @CraigV123 ,

Greetings for the day.

I would like to inform you that Cortex XDR does not natively provide a dashboard inventory or direct blocking of browser extensions by ID/name, you can configure detection and conduct threat hunts using XQL and existing behavioral modules.

1. Native Product Limitations:

-Cortex XDR operates primarily at the Operating System (OS) level. Because browser extensions run within the browser’s internal sandbox environment and do not typically create independent OS processes, the agent lacks native visibility into the internal list of loaded extensions.

-Direct management or blocking of specific extension IDs is a recognized product limitation, and several feature requests (CXDR-I-1134 and CXDR-I-146) exist to address this in future updates.

2. XQL Threat Hunting Ideas:

You can hunt for unauthorized extensions by searching for file activity in standard extension directories or extracting extension IDs from file paths.

A. Searching for Known Malicious IDs:

If you have a list of malicious or unauthorized extension IDs, you can search for their presence in the file system logs.

B. Extracting All Installed Extension IDs:

You can use regular expressions to extract 32-character extension IDs from file path events to create a list of what is running in your environment.

C. Locating Manifest Files:

To identify the name and details of an extension found via hunting, you can use the File Search and Destroy feature or Live Terminal to locate the manifest.json file associated with the identified ID:

3. Detection via Analytics and Behavioral Modules:

Cortex XDR includes built-in mechanisms to catch extensions when they exhibit malicious behavior:

Analytics Alerts: The platform can trigger the alert "A browser extension was installed or loaded in an uncommon way" based on suspicious installation methods (e.g., loading via special command-line arguments or LOLBIN processes).
Behavioral Threat Protection (BTP): If an extension attempts to drop a payload, steal credentials, or perform process injection, BTP and Anti-Exploit modules will block the action at the process level.

4. Recommended Management Strategy:

For proactive enforcement, it is recommended to supplement Cortex XDR with administrative tools designed for application-layer control:

Windows: Use Group Policy Objects (GPO) to configure the Extension Install Blocklist or Allowlist for Chrome and Edge.
macOS: Use Mobile Device Management (MDM) profiles to push browser configuration payloads.
Enterprise Browsers: Consider solutions such as Prisma Access Browser, which provide granular application-layer visibility into extension environments.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

Re: Cortex XDR Pro / Browser extensions

Alexandre_Jodoin — Tue, 24 Feb 2026 20:13:42 GMT

To add to the excellent suggestions made by susekar

I would suggest having a look at https://github.com/toborrm9/malicious_extension_sentry

Not saying you should run this tool, but have a look at this more specifically for a list of known malicious extensionID.

https://github.com/toborrm9/malicious_extension_sentry/blob/main/Malicious-Extensions.csv

topic Cortex XDR Pro / Browser extensions in Cortex XDR Discussions

Cortex XDR Pro / Browser extensions

Re: Cortex XDR Pro / Browser extensions

1. Native Product Limitations:

2. XQL Threat Hunting Ideas:

A. Searching for Known Malicious IDs:

B. Extracting All Installed Extension IDs:

C. Locating Manifest Files:

3. Detection via Analytics and Behavioral Modules:

4. Recommended Management Strategy:

Re: Cortex XDR Pro / Browser extensions