Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

cyberhaven-compromised-extensions.yaml

If anyone is following the cyberhaven breach. I have put together a query to search for the installs of the known malicious chrome extensions as described <https://arstechnica.com/security/2025/01/dozens-of-backdoored-chrome-extensions-discovered-on-2-6-million-devices/|here>

Updated with the most up-to-date list of IOCs
<https://gist.github.com/edmerrett/d1cba0e1fa8bd2bbe925925d3a141cc4>