Cross-source coverage

T1176 / ATT&CK

Software Extensions

34 rules · 33 families across 8 sources.

From MITRE ATT&CK 19.2

Adversaries may abuse software extensions to establish persistent access to victim systems. Software extensions are modular components that enhance or customize the functionality of software applications, including web browsers, Integrated Development Environments (IDEs), and other platforms. Extensions are typically installed via official marketplaces, app stores, or manually loaded by users, and they often inherit the permissions and access levels of the host application.

Malicious extensions can be introduced through various methods, including social engineering, compromised marketplaces, or direct installation by users or by adversaries who have already gained access to a system. Malicious extensions can be named similarly or identically to benign extensions in marketplaces. Security mechanisms in extension marketplaces may be insufficient to detect malicious components, allowing adversaries to bypass automated scanners or exploit trust established during the installation process. Adversaries may also abuse benign extensions to achieve their objectives, such as using legitimate functionality to tunnel data or bypass security controls.

The modular nature of extensions and their integration with host applications make them an attractive target for adversaries seeking to exploit trusted software ecosystems. Detection can be challenging due to the inherent trust placed in extensions during installation and their ability to blend into normal application workflows.

Tactics
Persistence
Platforms
Linux · macOS · Windows
Telemetry
WinEventLog:SecurityWinEventLog:Sysmonmacos:unifiedlogauditd:SYSCALLfs:fileeventsNSM:Flow

How MITRE says to detect it DET0092

Detection of Malicious or Unauthorized Software Extensions

Windows Analytic 0251

Installation or execution of a malicious browser or IDE extension, followed by abnormal registry entries or outbound network connections from the host application

  • WinEventLog:Security EventCode=4688
  • WinEventLog:Sysmon EventCode=11
  • WinEventLog:Sysmon EventCode=13, 14
  • WinEventLog:Sysmon EventCode=3, 22

macOS Analytic 0252

Installation of configuration profiles or plist entries associated with malicious or unauthorized browser extensions

  • macos:unifiedlog Execution of 'profiles install -type=configuration'
  • macos:unifiedlog Creation of .plist under /Library/Managed Preferences/
  • macos:unifiedlog Suspicious outbound traffic from browser binary to non-standard domains

Linux Analytic 0253

Manual or script-based installation of extension-like modules into browser config directories or IDE plugin paths, followed by suspicious network activity

  • auditd:SYSCALL execve
  • fs:fileevents creat
  • NSM:Flow Abnormal browser traffic volume or destination

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 34 above — a rule tagged a sub-technique covers this technique too.

Wazuh Core Ruleset

13 rules
Detection Severity Format
osquery: : BetternetVPN Chrome extension malware detected · osquery.name = BetternetVPN Low Wazuh XML
osquery: : Chrometana Chrome extension malware detected · osquery.name = Chrometana Low Wazuh XML
osquery: : CopyFish Chrome extension malware detected · osquery.name = CopyFish Low Wazuh XML
osquery: : Giphy Chrome extension malware detected · osquery.name = Giphy Low Wazuh XML
osquery: : HolaVPN Chrome extension malware detected · osquery.name = HolaVPN Low Wazuh XML
osquery: : InfinityNewTab Chrome extension malware detected · osquery.name = InfinityNewTab Low Wazuh XML
osquery: : MacOSInstallCore Chrome extension malware detected · osquery.name = MacOSInstallCore Low Wazuh XML
osquery: : SocialFixer Chrome extension malware detected · osquery.name = SocialFixer Low Wazuh XML
osquery: : TouchVPN Chrome extension malware detected · osquery.name = TouchVPN Low Wazuh XML
osquery: : unTabs Browser extension malware detected on path · osquery.name = unTabs_1 Low Wazuh XML

+ 3 more from Wazuh Core Ruleset → showing the 10 highest-severity

socfortress/Wazuh-Rules

7 rules · 6 families
Detection Severity Format
Sysmon - Event 1: Process creation · Brave Extension Loaded via Command Line (T1176) High Wazuh XML
Sysmon - Event 1: Process creation · Chrome Extension Loaded via Command Line (T1176) High Wazuh XML
Sysmon - Event 1: Process creation · Chromium-Based Extension Loaded via Command Line (T1176) 2 variants High Wazuh XML
Sysmon - Event 1: Process creation · Chromium-Based Extension Loaded via Command Line (T1176) 2 variants High Wazuh XML
Sysmon - Event 1: Process creation · Edge Extension Loaded via Command Line (T1176) High Wazuh XML
Sysmon - Event 1: Process creation · Opera Extension Loaded via Command Line (T1176) High Wazuh XML
Sysmon - Event 1: Process creation · Vivaldi Extension Loaded via Command Line (T1176) High Wazuh XML

elastic/protections-artifacts

5 rules
Detection Severity Format
Browser Native Messaging Registry Modification Undefined Elastic TOML
Chromium Extension Loaded from Unusual Parent Undefined Elastic TOML
Suspicious Browser Files Modification Undefined Elastic TOML
Suspicious Browser Preference File Modification Undefined Elastic TOML
Suspicious Browser Preferences File Modification Undefined Elastic TOML

SigmaHQ/sigma

3 rules
Detection Severity Format
ChromeLoader Malware Execution High Sigma
Suspicious Chromium Browser Instance Executed With Custom Extension High Sigma
Chromium Browser Instance Executed With Custom Extension Medium Sigma

elastic/detection-rules

3 rules
Detection Severity Format
Manual Loading of a Suspicious Chromium Extension High Elastic TOML
Uncommon Registry Persistence Change Medium Elastic TOML
Browser Extension Install Low Elastic TOML

chainguard-dev/osquery-defense-kit

1 rule
Detection Severity Format
Highlight chrome extensions with wide-ranging permissions that are not part of your whitelist Undefined osquery SQL

panther-labs/panther-analysis

1 rule
Detection Severity Format
OSQuery Detected Unwanted Chrome Extensions Medium Panther Python

splunk/security_content

1 rule
Detection Severity Format
Windows Disable Internet Explorer Addons Undefined SPL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.