Panther medium experimental python

OSQuery Detected Unwanted Chrome Extensions

Monitor for chrome extensions that could lead to a credential compromise.

View Source

Detection Logic

def rule(event):
    return "unwanted-chrome-extensions" in event.get("name") and event.get("action") == "added"


def title(event):
    return f"Unwanted Chrome extension(s) detected on [{event.get('hostIdentifier')}]"

Field Validations

Loading…

Comments (0)

Loading comments...