DET-MS-MDE-001 Defender for Endpoint Endpoint KQL Severity: Medium
Unauthorized AI browser extension installation
Detects installation of browser extensions identified as Shadow AI risk vectors on managed endpoints.
Rule
// Detect installation of high-risk AI browser extensions
let riskyExtensions = _GetWatchlist('AIBrowserExtensions') | project SearchKey, Name=tostring(Notes);
DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType in ('FileCreated', 'FileRenamed')
| where FolderPath has_any ('\\Chrome\\Extensions\\', '/Library/Application Support/Google/Chrome/Default/Extensions/', '/Library/Application Support/Microsoft Edge/Default/Extensions/')
| extend ExtensionId = extract(@'Extensions[\\/]([a-z]{32})', 1, FolderPath)
| where isnotempty(ExtensionId)
| where ExtensionId in (riskyExtensions)
| summarize InstallCount = count(), FirstSeen = min(Timestamp), Devices = make_set(DeviceName, 50)
by InitiatingProcessAccountUpn, ExtensionId// Detect installation of high-risk AI browser extensions
let riskyExtensions = _GetWatchlist('AIBrowserExtensions') | project SearchKey, Name=tostring(Notes);
DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType in ('FileCreated', 'FileRenamed')
| where FolderPath has_any ('\\Chrome\\Extensions\\', '/Library/Application Support/Google/Chrome/Default/Extensions/', '/Library/Application Support/Microsoft Edge/Default/Extensions/')
| extend ExtensionId = extract(@'Extensions[\\/]([a-z]{32})', 1, FolderPath)
| where isnotempty(ExtensionId)
| where ExtensionId in (riskyExtensions)
| summarize InstallCount = count(), FirstSeen = min(Timestamp), Devices = make_set(DeviceName, 50)
by InitiatingProcessAccountUpn, ExtensionId How it works
Monitors filesystem activity in browser extension directories. Cross-references installed extension IDs against the AIBrowserExtensions watchlist populated from the Service Catalog.
Required data sources
- Defender for Endpoint (DeviceFileEvents)
- Sentinel watchlist: AIBrowserExtensions
Prerequisites
- Defender for Endpoint P2 or M365 E5
- Watchlist populated from service-catalog browser extension entries
- Note: Chrome Enterprise policy is the preferred preventive control; this is the detective fallback
Expected volume
Low — 5–20/day in a typical org of 10k seats before prevention.
False-positive guidance
Some extension IDs change across major versions. Re-validate watchlist monthly.
Tuning steps
- Add Chrome Enterprise policy (BlockExternalExtensions) as preventive layer.
- Exclude IT testing devices.
Framework mappings
- NIST AI RMF: GOVERN-4.1, MEASURE-2.7
- ISO/IEC 42001: 8.2
- NIST CSF: DE.CM-7, PR.IP-1