windows_browsere-extensions.conf

{
  "platform": "windows",
  "description": "ATT&CK: T1176",
  "queries": {
    "chrome_extensions": {
        "query": "select u.username, ce.name,ce.identifier,ce.version,ce.description,ce.locale,ce.update_url,ce.author,ce.persistent,ce.path from chrome_extensions ce LEFT JOIN users u ON ce.uid = u.uid;",
        "interval": 3600,
        "description": "Lists all chrome extensions - ATT&CK T1176",
        "removed": false
    },
    "Snapshot_chrome_extensions": {
        "query": "select u.username, ce.name,ce.identifier,ce.version,ce.description,ce.locale,ce.update_url,ce.author,ce.persistent,ce.path from chrome_extensions ce LEFT JOIN users u ON ce.uid = u.uid;",
        "interval": 28800,
        "description": "Snapshot Lists all chrome extensions - ATT&CK T1176",
        "snapshot": true
    },
    "iexplorer_extensions": {
        "query": "select * from ie_extensions;",
        "interval": 3600,
        "description": "Lists all internet explorer extensions - ATT&CK T1176",
        "removed": false
    },
    "Snapshot_iexplorer_extensions": {
        "query": " select * from  ie_extensions;",
        "interval": 28800,
        "description": "Snapshot Lists all internet explorer extensions - ATT&CK T1176",
        "snapshot": true
    }
  }
}