kqlHunting

Top 100 devices with the most browser extensions installed

----

Detection Query

DeviceTvmBrowserExtensions
| summarize
     TotalExtensions = dcount(ExtensionId),
     ExtensionNames = make_set(ExtensionName)
     by DeviceId
| join kind=inner DeviceInfo on DeviceId
| project DeviceName, TotalExtensions, ExtensionNames
| top 100 by TotalExtensions

Data Sources

DeviceInfo

Platforms

windowsmicrosoft-defender

Tags

vulnerability-management

Raw Content

# Top 100 devices with the most browser extensions installed
----
## Defender XDR
```KQL
DeviceTvmBrowserExtensions
| summarize
     TotalExtensions = dcount(ExtensionId),
     ExtensionNames = make_set(ExtensionName)
     by DeviceId
| join kind=inner DeviceInfo on DeviceId
| project DeviceName, TotalExtensions, ExtensionNames
| top 100 by TotalExtensions
```