XQL query for searching extensions installed within an application

Showing results for 
Show  only  | Search instead for 
Did you mean: 

XQL query for searching extensions installed within an application

L1 Bithead

Hi All,

Looking for an XQL query to detect extensions installed from an applications marketplace to use within the application. For eg. someone installing "github actions" extension from the azure marketplace.


L4 Transporter

Hi @ShubhamT281, thanks for reaching us using the Live Community.


That could be possible if the application creates a file in disk when a new application/plugin is installed. For example in Chrome, when an extension is installed a file is created on a specific folder.

Then an XQL Query looking for the .exe process with a file creation on the folder, like this:


| filter event_type = ENUM.FILE and event_sub_type = ENUM.FILE_CREATE_NEW

| filter actor_process_image_name = "app.exe"


If this post answers your question, please mark it as the solution.


Hi @jmazzeo 

Unfortunately this is not the case with the extension that I am looking to search for, the extension is downloaded from the marketplace of the application and hence is not something browser related.

Is it possible to detect that via XDR ?


  • 2 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!