Techniques › T1176
T1176 Software Extensions
persistence — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
1
Sigma rules tagged attack.t1176
0
KEV CVEs mapped here
<p>Adversaries may abuse software extensions to establish persistent access to victim systems. Software extensions are modular components that enhance or customize the functionality of software applications, including web browsers, Integrated Development Environments (IDEs), and other platforms. Extensions are typically installed via official marketplaces, app stores, or manually loaded by users, and they often inherit the permissions and access levels of the host application.</p><p>Malicious extensions can be introduced through various methods, including social engineering, compromised marketplaces, or direct installation by users or by adversaries who have already gained access to a system. Malicious extensions can be named similarly or identically to benign extensions in marketplaces. Security mechanisms in extension marketplaces may be insufficient to detect malicious components, allowing adversaries to bypass automated scanners or exploit trust established during the installation process. Adversaries may also abuse benign extensions to achieve their objectives, such as using legitimate functionality to tunnel data or bypass security controls.</p><p>The modular nature of extensions and their integration with host applications make them an attractive target for adversaries seeking to exploit trusted software ecosystems. Detection can be challenging due to the inherent trust placed in extensions during installation and their ability to blend into normal application workflows.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0092 Detection of Malicious or Unauthorized Software Extensions v1.0
AN0251 WindowsInstallation or execution of a malicious browser or IDE extension, followed by abnormal registry entries or outbound network connections from the host applicationTunable:
ImageParentImageRegistryPathTimeWindowAN0252 macOSInstallation of configuration profiles or plist entries associated with malicious or unauthorized browser extensionsmacos:unifiedlogSuspicious outbound traffic from browser binary to non-standard domains→ DC0078 Network Traffic FlowTunable:PlistPathCommandLineTimeWindowAN0253 LinuxManual or script-based installation of extension-like modules into browser config directories or IDE plugin paths, followed by suspicious network activityTunable:DirectoryPathExecPathTimeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1176
Author: @kostastsale
· 2022-01-10 · logsource: product=windows category=process_creation · 0a74c5a9-1b71-4475-9af2-7829d320d5c2
Detects execution of ChromeLoader malware via a registered scheduled task