Pinned

1. osquery query to find systems that h... osquery query to find systems that have the compromised Mega Chrome Extension installed

   1

   -- Joins chrome_extension and users table, looks for Mega chrome identifier and specific version number; should also consider running without the version number, to find all users with Mega extension installed and then get it removed prior to it updating.

   2

   3

   SELECT users.username,chrome_extensions.name,chrome_extensions.version,chrome_extensions.path FROM chrome_extensions JOIN users ON users.uid = chrome_extensions.uid where chrome_extensions.identifier = 'bigefpfhnfcobdlfbedofhhaibnlghod' and chrome_extensions.version = '3.39.4';

2. WinTAP WinTAP Public

   Mirror network traffic from one interface to another on Windows

   C 24 13

3. Pertinax Pertinax Public

   Integrating Sysinternals Autoruns’ logs into Security Onion

   PowerShell 30 5