tfMITRE ATT&CK sub-technique

Browser Extensions T1176.001

sub-technique of T1176 Software Extensions

Tactic: Persistence
Platforms: Linux, Windows, macOS
Version: 1.1
Created: 30 March 2025
Last modified: 22 September 2025
Contributor: Gordon Long, LegioX/Zoom, asaurusrex

Adversaries may abuse internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality to and customize aspects of internet browsers. They can be installed directly via a local file or custom URL or through a browser's app store - an official online platform where users can browse, install, and manage extensions for a specific web browser. Extensions generally inherit the web browser's permissions previously granted.[1][2] Malicious extensions can be installed into a browser through malicious app store downloads masquerading as legitimate extensions, through social engineering, or by an adversary that has already compromised a system. Security can be limited on browser app stores, so it may not be difficult for malicious extensions to defeat automated scanners.[3] Depending on the browser, adversaries may also manipulate an extension's update url to install updates from an adversary-controlled server or manipulate the mobile configuration file to silently install additional extensions.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware68th pct

Tools & malware68th percentile · 68% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules54th pct

Detection rules54th percentile · 54% of ATT&CK techniques have this many detection rules written or fewer.

Browser Extensions MITRE reference T1176.001

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

KimsukyG0094 ↗

Has used Google Chrome browser extensions to infect victims and to steal passwords and cookies.1 2

created 2019-08-262 referencesaka Black Banshee

All 1 groups for this technique

Offense vs defense T1176.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 1

first rule: 2022 Q2

Browser Extensions detection strategy DET0044

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detecting Malicious Browser Extensions Across Platforms

Enterprise

3 platforms

AN0123 · Windows

Installation of a new browser extension followed by suspicious file writes or outbound network connections to untrusted domains by the browser process.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Windows Registry Key ModificationDC0063	WinEventLog:Sysmon	EventCode=13, 14
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserContext	Extension installation by privileged or domain users may require higher scrutiny
BrowserExecutablePath	Custom or portable browsers may not match default paths
ExtensionInstallPath	Installation paths may vary by version or user profile

AN0124 · macOS

Installation of malicious .mobileconfig profiles or browser extension plist entries followed by abnormal browser child process activity.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Unexpected child process of Safari or Chrome
File CreationDC0039	macos:unifiedlog	Creation or modification of browser extension .plist files
Command ExecutionDC0064	macos:unifiedlog	profiles install -type=configuration

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
PlistPath	Different versions may store extensions in variant preference folders
CommandLineFlags	May vary with OS version; some install flags deprecated in macOS 11+

AN0125 · Linux

Manual or scripted installation of Chrome extensions using user scripts or config files, followed by unexpected network connections from browser processes.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
File AccessDC0055	auditd:SYSCALL	open
Network Traffic ContentDC0085	NSM:Flow	Browser connections to known C2 or dynamic DNS domains

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ExtensionDir	Location of Chrome/Chromium extensions under user profile may vary
DomainWatchlist	Custom list of suspicious destination domains for browser traffic

Browser Extensions detections T1176.001

3 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

54th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs