FleetDM Query: Cyberhaven compromised Chrome extensions

cyberhaven-compromised-extensions.yaml

---
apiVersion: v1
kind: query
spec:
  automations_enabled: false
  description: |-
    Looks for a list of known compromised chrome extensions based on:

    https://arstechnica.com/security/2025/01/dozens-of-backdoored-chrome-extensions-discovered-on-2-6-million-devices/
    https://www.extensiontotal.com/cyberhaven-incident-live
  discard_data: false
  interval: 0
  logging: snapshot
  min_osquery_version: ""
  name: cyberhaven compromised extensions
  observer_can_run: false
  platform: ""
  query: "SELECT \n    u.username, \n    ce.name, \n    ce.description, \n    ce.version,
    \n    ce.identifier\nFROM users u \nCROSS JOIN chrome_extensions ce USING (uid)
    \nWHERE ce.identifier IN (\n    \"nnpnnpemnckcfdebeekibpiijlicmpom\",\n    \"kkodiihpgodmdankclfibbiphjkfdenh\",\n
    \   \"oaikpkmjciadfpddlpjjdapglcihgdle\",\n    \"dpggmcodlahmljkhlmpgpdcffdaoccni\",\n
    \   \"acmfnomgphggonodopogfbmkneepfgnh\",\n    \"mnhffkhmpnefgklngfmlndmkimimbphc\",\n
    \   \"cedgndijpacnfbdggppddacngjfdkaca\",\n    \"bbdnohkpnbkdkmnkddobeafboooinpla\",\n
    \   \"egmennebgadmncfjafcemlecimkepcle\",\n    \"bibjgkidgpfbblifamdlkdlhgihmfohh\",\n
    \   \"befflofjcniongenjmbkgkoljhgliihe\",\n    \"pkgciiiancapdlpcbppfkmeaieppikkk\",\n
    \   \"llimhhconnjiflfimocjggfjdlmlhblm\",\n    \"oeiomhmbaapihbilkfkhmlajkeegnjhe\",\n
    \   \"pajkjnmeojmbapicmbpliphjmcekeaac\",\n    \"ndlbedplllcgconngcnfmkadhokfaaln\",\n
    \   \"epdjhgbipjpbbhoccdeipghoihibnfja\",\n    \"cplhlgabfijoiabgkigdafklbhhdkahj\",\n
    \   \"jiofmdifioeejeilfkpegipdjiopiekl\",\n    \"hihblcmlaaademjlakdpicchbjnnnkbo\",\n
    \   \"ekpkdmohpdnebfedjjfklhpefgpgaaji\",\n    \"epikoohpebngmakjinphfiagogjcnddm\",\n
    \   \"miglaibdlgminlepgeifekifakochlka\",\n    \"eanofdhdfbcalhflpbdipkjjkoimeeod\",\n
    \   \"ogbhbgkiojdollpjbhbamafmedkeockb\",\n    \"bgejafhieobnfpjlpcjjggoboebonfcg\",\n
    \   \"igbodamhgjohafcenbcljfegbipdfjpk\",\n    \"mbindhfolmpijhodmgkloeeppmkhpmhc\",\n
    \   \"hodiladlefdpcbemnbbcpclbmknkiaem\",\n    \"lbneaaedflankmgmfbmaplggbmjjmbae\",\n
    \   \"eaijffijbobmnonfhilihbejadplhddo\",\n    \"hmiaoahjllhfgebflooeeefeiafpkfde\"\n);"
  team: ""

Updated 12:01 GMT 6th Jan 2025 with full list of chrome extension IOCs provided by Cybnerhaven incident blog.