This query identifies endpoints (devices) that have browser extensions installed with permissions that allow them to turn off malware protections. It uses data from the Threat and Vulnerability Management (TVM) add-on in Microsoft Defender XDR.

Here's a simplified breakdown of what the query does:

1. Filter Extensions with Specific Permissions: It first filters the DeviceTvmBrowserExtensionsKB table to find browser extensions that have the permission "Can turn off malware protections".

2. Extract Relevant Data: It extracts relevant information such as ExtensionId, ExtensionName, ExtensionRisk, and PermissionName from the filtered extensions.

3. Get Installed Extensions: It retrieves the ExtensionId and DeviceId from the DeviceTvmBrowserExtensions table to identify which extensions are installed on which devices.

4. Get Device Information: It extracts DeviceId and DeviceName from the DeviceInfo table to get the names of the devices.

5. Combine Data: It combines the data from the three tables (DeviceTvmBrowserExtensionsKB, DeviceTvmBrowserExtensions, and DeviceInfo) to match extensions with devices and their respective permissions.

6. Summarize Results: Finally, it summarizes the results to show the device name, extension name, and extension risk for each device that has an extension with the risky permission.

Summary of Output

The output will list devices along with the names and risk levels of the browser extensions installed on them that have the permission to turn off malware protections.

Versioning

• Version 1.0: Initial publish on 29/08/2024.