Inventory of Installed Browser Extensions Across Endpoints

# --- Query Metadata ---
# Human-readable name for the query. Will be displayed as the title.
name: Inventory of Installed Browser Extensions Across Endpoints

# Description of what the query does and its purpose.
description: The query lists installed browser (Chrome & Edge) extensions across endpoints, normalizes browser names, counts unique systems per extension, adds a Chrome Web Store link, and sorts results to highlight the most common extensions.

# The author or team that created the query.
author: CrowdStrike

# The required log sources to run this query successfully in Next-Gen SIEM.
# This will be displayed in the UI to inform the user.
log_sources:
  - Endpoint

# The CrowdStrike modules required to run this query.
cs_required_modules:
  - Insight

# Tags for filtering and categorization.
# Include relevant techniques, tactics, or platforms.
tags:
  - Hunting

# --- Query Content ---
# The actual CrowdStrike Query Language (CQL) code.
# Using the YAML block scalar `|` allows for multi-line strings.
cql: |
  #event_simpleName=InstalledBrowserExtension BrowserExtensionId!="no-extension-available"
  | groupBy([event_platform, BrowserName, BrowserExtensionId, BrowserExtensionName], function=([count(aid, distinct=true, as=TotalEndpoints)]))
  | format("[See Extension](https://chromewebstore.google.com/detail/%s)", field=[BrowserExtensionId], as="Chrome Store Link")
  | sort(order=desc, TotalEndpoints, limit=1000)
  | case{
      BrowserName="3" | BrowserName:="Chrome";
      BrowserName="4" | BrowserName:="Edge";
      *;
  }

# Explanation of the query.
# Using the YAML block scalar `|` allows for multi-line strings.
# Uses markdown for formatting on the webpage.
explanation: |
  Reference: [GitHub CrowdStrike/logscale-community](https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Enumerate%20Chrome%20%2B%20Edge%20Browser%20Extension%20on%20Win%20and%20Mac.md)