Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1176.001sub-technique of T1176 Software Extensions

Browser Extensions

Linux · Windows · macOSnothing on this site yetT1176.001 on attack.mitre.org

Adversaries may abuse internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality to and customize aspects of internet browsers. They can be installed directly via a local file or custom URL or through a browser's app store - an official online platform where users can browse, install, and manage extensions for a specific web browser.

MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

1

Checklists and playbooks to open while the alert is still live.

how MITRE says to see it

Detecting Malicious Browser Extensions Across Platforms

  • Installation of a new browser extension followed by suspicious file writes or outbound network connections to untrusted domains by the browser process.
  • Installation of malicious.mobileconfig profiles or browser extension plist entries followed by abnormal browser child process activity.
  • Manual or scripted installation of Chrome extensions using user scripts or config files, followed by unexpected network connections from browser processes.

what reduces it

  • M1033 Limit Software Installation. Only install browser extensions from trusted sources that can be verified. Browser extensions for some browsers can be controlled through Group Policy. Change settings to prevent the browser from installing extensions without sufficient permissions.
  • M1017 User Training. Close out all browser sessions when finished using them to prevent any potentially malicious extensions from continuing to run.
  • M1038 Execution Prevention. Set a browser extension allow or deny list as appropriate for your security policy.
  • M1047 Audit. Ensure extensions that are installed are the intended ones, as many malicious extensions will masquerade as legitimate ones.
  • M1051 Update Software. Ensure operating systems and browsers are using the most current version.

the rest of T1176

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.