Possible Malicious Browser Extension Loaded
Query
DeviceProcessEvents
| where FileName has_any('chrome.exe','msedge.exe')
and ProcessCommandLine contains "--load-extension"Explanation
Show me all events related to processes with file names "chrome.exe" or "msedge.exe" where the process command line contains "--load-extension".