Browser Extensions - Chrome Extensions

let KnownExtensions = datatable(ExtensionName:string, ExtensionId:string)
[
//Official Google Extensions, installed by default
"Google Mail","pjkljhegncpnkpknbcohdijeoejaedia",
"Google Drive","apdfllckaahabafndbhieahigkjlhalf",
"Google Docs","aohghmighlieiainnegkcijnfilokake",
"Google Docs Offline","ghbmnnjooekpmoecnnnilnnbdlolhkhi",
"Google Sheets","felcaaldnbdncclmgdcncolpebgiejap",
"Google Slides","aapocclcgogkmnckokdopfmhonfmgoek",
"YouTube","blpcfgokakmgnkcojhhkbfbldkacnbeo",
// Deprecated Google Extensions, transitioned into the browser
"Chrome PDF Viewer","mhjfbmdgcfjbbpaeojofohoefgiehjai",
"Google Wallet","nmmhkkegccagdldgiimedpiccmgmieda",
"Chrome Cast","pkedcjkdefgpdelpbcmbmeomcjbeemfm",
"Google Web Store","nmmhkkegccagdldgiimedpiccmgmieda",
// Some other commonly observed security Extensions
"AdBlock","gighmmpiobklfepjocnamgkkbiglidom",
"AdBlock Plus","cfhdojbkjhnklbpkdaibdccddilifddb",
"uBlock","epcnnfbjfcgphgdmggkamkmgojdagdnn",
"uBlock Origin","cjpalhdlnbpafiamejdnhcphjbkeiagm",
"Ghostery","mlomiejdfkolichcflejclcbmpeaniij",
"Privacy Badger","pkehgijcmpdhfbdbbnkijodmdjhbjlgp",
"Disconnect","jeoacafpbcihiomhlakheieifhpjdfeo",
"HTTPS Everywhere","gcbommkclmclpchllfjekcdonpmejbdp",
// Some other known Extensions
"Adobe Acrobat","efaidnbmnnnibpcajpcglclefindmkaj",
"Foxit PDF Creator","cifnddnffldieaamihfkhkdgnbhfmaci",
"Cisco Webex Extension","jlhmfgmfgeifomenelglieieghnjghma",
"Google Translate","aapbdbdomjkkjkaonfhkkikfgjllcleb"
];
DeviceFileEvents
| where ActionType == "FileCreated" and (InitiatingProcessFileName contains "chrome" or InitiatingProcessFileName contains "edge" or InitiatingProcessFileName contains "brave" or InitiatingProcessFileName contains "vivaldi")  and (FolderPath contains "User Data\\Default\\Extensions" or FolderPath endswith ".crx") and FolderPath notcontains "Temp"
| extend ExtensionId = extract("([a-z]{32})", 1, FolderPath)
| summarize count() by ExtensionId, DeviceName
| join kind = leftouter (KnownExtensions
| project ExtensionId = tolower(ExtensionId), ExtensionName) on ExtensionId
| project ExtensionName,ExtensionId, DeviceName
| sort by ExtensionName asc