osquery-defense-kit/incident_response/chrome_extension_content_scripts.sql
2023-02-23 09:35:38 -05:00

7 lines
268 B
SQL

-- Retrieves chrome extension cotent scripts that execute on a broad set of URLs.
-- tags: postmortem
-- platform: posix
SELECT chrome_extension_content_scripts.*
FROM users
JOIN chrome_extension_content_scripts ON users.uid = chrome_extension_content_scripts.uid