{"id":"T1176.001","name":"Browser Extensions","url":"https://attack.mitre.org/techniques/T1176/001","tactics":["persistence"],"platforms":["Linux","Windows","macOS"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0044","stix_id":"x-mitre-detection-strategy--101e19ca-f902-4c2d-8ceb-ddd07a43f1a7","name":"Detecting Malicious Browser Extensions Across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0044","analytics":[{"id":"AN0123","stix_id":"x-mitre-analytic--db45c19b-d9d6-4794-8b49-ba232cca34b0","name":"Analytic 0123","description":"Installation of a new browser extension followed by suspicious file writes or outbound network connections to untrusted domains by the browser process.","url":"https://attack.mitre.org/detectionstrategies/DET0044#AN0123","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"UserContext","description":"Extension installation by privileged or domain users may require higher scrutiny"},{"field":"BrowserExecutablePath","description":"Custom or portable browsers may not match default paths"},{"field":"ExtensionInstallPath","description":"Installation paths may vary by version or user profile"}],"live":true,"detection_strategies":["DET0044"],"techniques":["T1176.001"]},{"id":"AN0124","stix_id":"x-mitre-analytic--41153f33-d415-4e1d-b3c8-7333b2f1915e","name":"Analytic 0124","description":"Installation of malicious .mobileconfig profiles or browser extension plist entries followed by abnormal browser child process activity.","url":"https://attack.mitre.org/detectionstrategies/DET0044#AN0124","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"profiles install -type=configuration","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"Creation or modification of browser extension .plist files","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"Unexpected child process of Safari or Chrome","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"PlistPath","description":"Different versions may store extensions in variant preference folders"},{"field":"CommandLineFlags","description":"May vary with OS version; some install flags deprecated in macOS 11+"}],"live":true,"detection_strategies":["DET0044"],"techniques":["T1176.001"]},{"id":"AN0125","stix_id":"x-mitre-analytic--b5020e23-475e-4f74-a943-787e090d3e2f","name":"Analytic 0125","description":"Manual or scripted installation of Chrome extensions using user scripts or config files, followed by unexpected network connections from browser processes.","url":"https://attack.mitre.org/detectionstrategies/DET0044#AN0125","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"open","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"auditd-syscall"},{"name":"NSM:Flow","channel":"Browser connections to known C2 or dynamic DNS domains","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"},{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"ExtensionDir","description":"Location of Chrome/Chromium extensions under user profile may vary"},{"field":"DomainWatchlist","description":"Custom list of suspicious destination domains for browser traffic"}],"live":true,"detection_strategies":["DET0044"],"techniques":["T1176.001"]}],"live":true,"version":"1.0","techniques":["T1176.001"]}],"sigma_rules":[{"id":"27ba3207-dd30-4812-abbf-5d20c57d474e","title":"Suspicious Chromium Browser Instance Executed With Custom Extension","author":"Aedan Russell, frack113, X__Junior (Nextron Systems)","status":"test","level":"high","date":"2022-06-19","modified":"2023-11-28","description":"Detects a suspicious process spawning a Chromium based browser process with the 'load-extension' flag to start an instance with a custom extension","references":["https://redcanary.com/blog/chromeloader/","https://emkc.org/s/RJjuLa","https://www.mandiant.com/resources/blog/lnk-between-browsers"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.t1176.001"],"path":"rules/windows/process_creation/proc_creation_win_browsers_chromium_susp_load_extension.yml","techniques":["T1176.001"],"cves":[]},{"id":"88d6e60c-759d-4ac1-a447-c0f1466c2d21","title":"Chromium Browser Instance Executed With Custom Extension","author":"Aedan Russell, frack113, X__Junior (Nextron Systems)","status":"test","level":"medium","date":"2022-06-19","modified":"2023-11-28","description":"Detects a Chromium based browser process with the 'load-extension' flag to start a instance with a custom extension","references":["https://redcanary.com/blog/chromeloader/","https://emkc.org/s/RJjuLa","https://www.mandiant.com/resources/blog/lnk-between-browsers"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.t1176.001"],"path":"rules/windows/process_creation/proc_creation_win_browsers_chromium_load_extension.yml","techniques":["T1176.001"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}