The VMware Carbon Black Tech Zone is live! Checkout this great resource: Mastering Carbon Black Audit & Remediation.

Chrome Extension by User (Profile)

Description: Looks for Chrome extensions and who has them.

What The Data Shows: You will be able to see what Chrome extension you have in your environment, as well as who has them.  Even if they are "clean," you can always reach out to the person to find out what they are using the extension for.

SQL:

SELECT uid,name,identifier,version,locale 
FROM chrome_extensions;

 

2 Comments
esullivan
Carbon Black Employee

Hello @prousseau thank you for your contribution!  We'll vet this submission and if it runs as expected we'll change this status of your query from Under Review to CB Approved.

Thanks again!

Ed Sullivan

tmccormack
Carbon Black Employee

Hi, we noticed your using a column "profile" which isn't actually available with the chrome_extensions table. Please update your SQL with the appropriate column. You can view the options here at https://osquery.io/schema/3.3.2#chrome_extensions. Please make sure to test your query before submitting! Thank you.