XQL query for searching extensions installed within an application

[ShubhamT281]

Hi All,

Looking for an XQL query to detect extensions installed from an applications marketplace to use within the application. For eg. someone installing "github actions" extension from the azure marketplace.

[jmazzeo]

Hi @ShubhamT281, thanks for reaching us using the Live Community.

That could be possible if the application creates a file in disk when a new application/plugin is installed. For example in Chrome, when an extension is installed a file is created on a specific folder.

Then an XQL Query looking for the .exe process with a file creation on the folder, like this:

| filter event_type = ENUM.FILE and event_sub_type = ENUM.FILE_CREATE_NEW

| filter actor_process_image_name = "app.exe"

If this post answers your question, please mark it as the solution.

[ShubhamT281]

Hi @jmazzeo 

Unfortunately this is not the case with the extension that I am looking to search for, the extension is downloaded from the marketplace of the application and hence is not something browser related.

Is it possible to detect that via XDR ?