Detect Software Extensions in Sumo Logic CSE

_sourceCategory=*windows*sysmon* OR _sourceCategory=*sysmon*
| parse "<EventID>*</EventID>" as EventID nodrop
| parse "<TargetFilename>*</TargetFilename>" as TargetFilename nodrop
| parse "<TargetObject>*</TargetObject>" as TargetObject nodrop
| parse "<CommandLine>*</CommandLine>" as CommandLine nodrop
| parse "<Image>*</Image>" as Image nodrop
| parse "<Computer>*</Computer>" as Computer nodrop
| parse "<User>*</User>" as User nodrop
| where
  (
    EventID = "11"
    and (
      TargetFilename matches "*AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions*"
      or TargetFilename matches "*AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Extensions*"
      or TargetFilename matches "*AppData\\Roaming\\Mozilla\\Firefox\\Profiles*"
      or TargetFilename matches "*.vscode\\extensions*"
      or TargetFilename matches "*AppData\\Roaming\\Code\\extensions*"
    )
    and (
      TargetFilename matches "*.crx"
      or TargetFilename matches "*.xpi"
      or TargetFilename matches "*.vsix"
      or TargetFilename matches "*.js"
      or TargetFilename matches "*manifest.json"
    )
    and not (
      Image matches "*\\chrome.exe"
      or Image matches "*\\msedge.exe"
      or Image matches "*\\firefox.exe"
      or Image matches "*\\Code.exe"
      or Image matches "*\\brave.exe"
      or Image matches "*\\MicrosoftEdgeUpdate.exe"
      or Image matches "*\\GoogleUpdate.exe"
    )
  )
  or (
    EventID in ("12", "13", "14")
    and (
      TargetObject matches "*ExtensionInstallForcelist*"
      or TargetObject matches "*ExtensionInstallAllowlist*"
      or TargetObject matches "*ExtensionInstallBlacklist*"
      or (
        TargetObject matches "*\\Extensions\\*"
        and (
          TargetObject matches "*\\Chrome\\*"
          or TargetObject matches "*\\Edge\\*"
          or TargetObject matches "*\\Chromium\\*"
        )
      )
    )
  )
  or (
    EventID = "1"
    and (
      CommandLine matches "*--load-extension*"
      or CommandLine matches "*--packed-extension*"
      or CommandLine matches "*--allow-outdated-plugins*"
      or CommandLine matches "*code --install-extension*"
      or CommandLine matches "*code-insiders --install-extension*"
      or (CommandLine matches "*.vsix*" and CommandLine matches "*install*")
      or (
        CommandLine matches "*.crx*"
        and (CommandLine matches "*chrome*" or CommandLine matches "*edge*" or CommandLine matches "*brave*")
      )
    )
  )
| eval DetectionType = if(EventID = "11", "SuspiciousExtensionFileWrite",
    if(EventID in ("12", "13", "14"), "ExtensionRegistryForceInstall",
    if(EventID = "1", "ExtensionCLIInstall", "Unknown")))
| eval ArtifactPath = if(EventID = "11", TargetFilename,
    if(EventID in ("12", "13", "14"), TargetObject, CommandLine))
| fields _messageTime, Computer, User, Image, CommandLine, ArtifactPath, DetectionType, EventID
| sort by _messageTime desc