T1176
Software Extensions
Linux · macOS · Windowsnothing on this site yetT1176 on attack.mitre.org
Adversaries may abuse software extensions to establish persistent access to victim systems. Software extensions are modular components that enhance or customize the functionality of software applications, including web browsers, Integrated Development Environments (IDEs), and other platforms.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
how MITRE says to see it
Detection of Malicious or Unauthorized Software Extensions
- Installation or execution of a malicious browser or IDE extension, followed by abnormal registry entries or outbound network connections from the host application
- Installation of configuration profiles or plist entries associated with malicious or unauthorized browser extensions
- Manual or script-based installation of extension-like modules into browser config directories or IDE plugin paths, followed by suspicious network activity
what reduces it
- M1033 Limit Software Installation. Only install extensions from trusted sources that can be verified.
- M1017 User Training. Train users to minimize extension use, and to only install trusted extensions.
- M1038 Execution Prevention. Set an extension allow or deny list as appropriate for your security policy.
- M1047 Audit. Ensure extensions that are installed are the intended ones, as many malicious extensions may masquerade as legitimate ones.
- M1051 Update Software. Ensure operating systems and software are using the most current version.