Firefox Extensions

[SorinP]

Hello guys, this is my first post, I'm glad I can be part of this community, I tried to make a query to see what extensions are installed in Firefox. I hope it is ok and useful and if you have something to add to improve it, I would be very happy.

config case_sensitive = true

| preset = xdr_file
| filter agent_os_type = AGENT_OS_WINDOWS
| filter event_sub_type = FILE_CREATE_NEW
| filter causality_actor_process_image_name = "firefox.exe"
| filter action_file_path contains "C:\Users\*\AppData\Roaming\Mozilla\Firefox\Profiles\*\extensions"
| filter action_file_name not contains "Zone.Identifier"
| alter action_file_name = split(action_file_name, "_")
| arrayexpand action_file_name
| filter action_file_name not contains "tmp"
| fields _time as Time, agent_hostname as Hostname, agent_ip_addresses as IPv4, actor_effective_username as User, action_file_name as extensionID, action_file_sha256

[abdrahman]

Dear @SorinP 

Hope you are doing well and thank you for reaching out to our Live Community. From the query I see above, it seems to be perfectly fine when it comes to Firefox extensions details. I do not find anything else as such which could be added to this query as this alone provides a lot of information. Thank you. 

Please reach out to us again if there is anything else you think could be added but not sure how to do it and we shall be happy to assist you further. Thank you. 

Regards,