Chrome - Chrome Extension Install Event

This rule alerts on any installation of a browser extension

Google Chrome LOW PERSISTENCE

Details

ID6530cad5-856d-4d38-b305-63b9567d4c48
From Version8.4.0
Execution ModeREAL_TIME
Datasetalerts

MITRE ATT&CK

  • TA0003 - Persistence
    • T1176 - Browser Extensions

XQL Query

datamodel dataset = google_workspace_chrome_raw
| filter xdm.event.type in ("BROWSER_EXTENSION_INSTALL")
| fields xdm.event.type, xdm.observer.action, xdm.event.description, xdm.event.outcome_reason, xdm.source.user.username, xdm.intermediate.user.username, xdm.source.host.hostname, xdm.source.host.os, xdm.source.host.os_family, xdm.network.http.browser, xdm.source.user_agent, xdm.target.resource.name, xdm.target.resource.id

Investigation Query

datamodel dataset = google_workspace_chrome_raw 
| filter xdm.event.type in ("BROWSER_EXTENSION_INSTALL")
| filter xdm.intermediate.user.username = $xdm.intermediate.user.username and xdm.source.host.hostname = $xdm.source.host.hostname and xdm.target.resource.name = $xdm.target.resource.name