Pinned Loading

1. osquery query to find systems that h... osquery query to find systems that have the compromised Mega Chrome Extension installed

   1

   -- Joins chrome_extension and users table, looks for Mega chrome identifier and specific version number; should also consider running without the version number, to find all users with Mega extension installed and then get it removed prior to it updating.

   2

   3

   SELECT users.username,chrome_extensions.name,chrome_extensions.version,chrome_extensions.path FROM chrome_extensions JOIN users ON users.uid = chrome_extensions.uid where chrome_extensions.identifier = 'bigefpfhnfcobdlfbedofhhaibnlghod' and chrome_extensions.version = '3.39.4';

2. osquery-filters osquery-filters Public

   Go 34 1