Correlation Rule
Low
✕
Chrome - Chrome Extension Install Event
The extension $xdm.target.resource.name was installed on $xdm.source.host.hostname by $xdm.intermediate.user.username
- Module:
- Platform Analytics
- Data source:
- google_workspace_chrome_raw
- Category:
- Persistence
- Content pack:
- Google Chrome
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Browser Extensions (T1176)
- Execution:
- REAL_TIME
- Search window:
XQL query:
datamodel dataset = google_workspace_chrome_raw | filter xdm.event.type in ("BROWSER_EXTENSION_INSTALL") | fields xdm.event.type, xdm.observer.action, xdm.event.description, xdm.event.outcome_reason, xdm.source.user.username, xdm.intermediate.user.username, xdm.source.host.hostname, xdm.source.host.os, xdm.source.host.os_family, xdm.network.http.browser, xdm.source.user_agent, xdm.target.resource.name, xdm.target.resource.id