Defender browser-extension data — licensing notes
Review the source's licensing dependency for the Defender browser-extension table and its example hunting query. The notes are a feature-gap assessment, not confirmation of a purchased entitlement.
Source-derived reference
These notes were recovered from OneNote. Configuration, permissions and operating results have not been freshly verified. Confirm the applicable authority and environment before acting.
Missing "Add-on MS Defender Vulnerability Management"
SUMMARY: **Will give us the Browser Extensions Table(DeviceTvmBrowserExtensions) in Advanced Hunting
The "Microsoft Defender Vulnerability Management"** Add-on license will allow us to see all browserExtensions on all devices from the DeviceTvmBrowserExtensions table in Advanced Hunting in Defender.
Query conditional on the recorded licensing dependency
The source proposes the following KQL to list browser extensions if the licensing dependency is met.
This KQL example looks for all devices that are trying to access yandex.ru and then gets the browser extensions for all of those devices.
// 1. Devices making calls to yandex.ru from browsers (last 7 days)
let yandexDevices = DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl contains "yandex.ru"
| where InitiatingProcessName in ("chrome.exe", "msedge.exe", "firefox.exe")
| distinct DeviceId, DeviceName, AccountName;
// 2. Show ALL extensions on those devices
DeviceTvmBrowserExtensions
| where DeviceId in (yandexDevices)
| join kind=inner yandexDevices on DeviceId
| project DeviceName, AccountName, BrowserName, ExtensionName, ExtensionId, ExtensionVersion, IsEnabled, ExtensionRisk, Permissions
| order by DeviceName, BrowserName, ExtensionRisk desc
WITHOUT THE LICENSE
You have to hack your way around it. Currently attempting with this Remediation script to return some data on the extensions.
CCMCO: Collect List of Browser Extensions - Intune Remediation to reduce the output the source proposes one remediation for Google Chrome and another for Internet Explorer. Alternatively you could run a script that saves the information to AzureBLOB or FTP storage.