cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Who rated this post

Firefox Extensions

L0 Member

Hello guys, this is my first post, I'm glad I can be part of this community, I tried to make a query to see what extensions are installed in Firefox. I hope it is ok and useful and if you have something to add to improve it, I would be very happy.

 

config case_sensitive = true

| preset = xdr_file
| filter agent_os_type = AGENT_OS_WINDOWS
| filter event_sub_type = FILE_CREATE_NEW
| filter causality_actor_process_image_name = "firefox.exe"
| filter action_file_path contains "C:\Users\*\AppData\Roaming\Mozilla\Firefox\Profiles\*\extensions"
| filter action_file_name not contains "Zone.Identifier"
| alter action_file_name = split(action_file_name, "_")
| arrayexpand action_file_name
| filter action_file_name not contains "tmp"
| fields _time as Time, agent_hostname as Hostname, agent_ip_addresses as IPv4, actor_effective_username as User, action_file_name as extensionID, action_file_sha256

Who rated this post