Browser extension registered or force-installed via registry

Siemphony@siemphonymediumT1176unverifiedPlaybook · Credential theft

Matches registry value writes that enrol a browser extension outside the browser's own UI: the enterprise policy force-list and ExtensionSettings keys, the legacy per-extension `Extensions\<id>` registration used to side-load an unpacked or hosted extension, and the NativeMessagingHosts registration that gives an extension a local executable to talk to. MITRE's AN0251 wants the install correlated with follow-on C2 traffic from the host application inside a tunable TimeWindow; Sigma cannot join two events, so this is the install-side precursor only and the network half is deliberately absent. TargetObject is the one field in Sysmon EventID 13 that carries the enrolment intent, so the whole rule sits on it and MITRE's RegistryPath knob is the tuning surface. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0092, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Browser extension registered or force-installed via registry2id: 3b7c1e4a-9d62-4f18-a0c5-27e6b8d413f93status: experimental4description: |5  Matches registry value writes that enrol a browser extension outside the6  browser's own UI: the enterprise policy force-list and ExtensionSettings keys,7  the legacy per-extension `Extensions\<id>` registration used to side-load an8  unpacked or hosted extension, and the NativeMessagingHosts registration that9  gives an extension a local executable to talk to. MITRE's AN0251 wants the10  install correlated with follow-on C2 traffic from the host application inside a11  tunable TimeWindow; Sigma cannot join two events, so this is the install-side12  precursor only and the network half is deliberately absent. TargetObject is the13  one field in Sysmon EventID 13 that carries the enrolment intent, so the whole14  rule sits on it and MITRE's RegistryPath knob is the tuning surface.15  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0092, not hand-written and not tested by its author. Any lab result is on this rule's own page.16references:17  - https://attack.mitre.org/techniques/T117618  - https://attack.mitre.org/detectionstrategies/DET009219author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)20date: 2026-08-1621tags:22  - attack.persistence23  - attack.t117624logsource:25  category: registry_set26  product: windows27detection:28  selection:29    TargetObject|contains:30      - '\Policies\Google\Chrome\ExtensionInstallForcelist\'31      - '\Policies\Google\Chrome\ExtensionSettings\'32      - '\Policies\Microsoft\Edge\ExtensionInstallForcelist\'33      - '\Policies\Microsoft\Edge\ExtensionSettings\'34      - '\Policies\BraveSoftware\Brave\ExtensionInstallForcelist\'35      - '\Google\Chrome\Extensions\'36      - '\Microsoft\Edge\Extensions\'37      - '\Chromium\Extensions\'38      - '\Mozilla\Firefox\Extensions\'39      - '\NativeMessagingHosts\'40  condition: selection41falsepositives:42  - "Group Policy or an MDM agent pushing an approved extension force-list, which rewrites the whole numbered list on every policy refresh and so re-fires on a schedule. The write comes from the policy client or the management agent, and MITRE names Image and RegistryPath as the knobs — baseline the approved extension IDs rather than the key prefix."43  - "Browser installers and updaters registering bundled or recommended extensions under `\\Google\\Chrome\\Extensions\\` and `\\Microsoft\\Edge\\Extensions\\` at each version bump. MITRE's ParentImage knob covers this — the writing process is the vendor updater rather than a script."44  - "Password managers, endpoint agents and conferencing clients that register their own browser extension and a NativeMessagingHosts entry during installation. These are indistinguishable from the malicious case on TargetObject alone, which is why the extension ID in the key path has to be allow-listed."45level: medium

Sentinel · KQL

Run this as a search.

DeviceRegistryEvents| where (RegistryKey contains "\\Policies\\Google\\Chrome\\ExtensionInstallForcelist\\" or RegistryKey contains "\\Policies\\Google\\Chrome\\ExtensionSettings\\" or RegistryKey contains "\\Policies\\Microsoft\\Edge\\ExtensionInstallForcelist\\" or RegistryKey contains "\\Policies\\Microsoft\\Edge\\ExtensionSettings\\" or RegistryKey contains "\\Policies\\BraveSoftware\\Brave\\ExtensionInstallForcelist\\" or RegistryKey contains "\\Google\\Chrome\\Extensions\\" or RegistryKey contains "\\Microsoft\\Edge\\Extensions\\" or RegistryKey contains "\\Chromium\\Extensions\\" or RegistryKey contains "\\Mozilla\\Firefox\\Extensions\\" or RegistryKey contains "\\NativeMessagingHosts\\")

Splunk · SPL

Run this as a search.

index=* (TargetObject="*\\Policies\\Google\\Chrome\\ExtensionInstallForcelist\\*" OR TargetObject="*\\Policies\\Google\\Chrome\\ExtensionSettings\\*" OR TargetObject="*\\Policies\\Microsoft\\Edge\\ExtensionInstallForcelist\\*" OR TargetObject="*\\Policies\\Microsoft\\Edge\\ExtensionSettings\\*" OR TargetObject="*\\Policies\\BraveSoftware\\Brave\\ExtensionInstallForcelist\\*" OR TargetObject="*\\Google\\Chrome\\Extensions\\*" OR TargetObject="*\\Microsoft\\Edge\\Extensions\\*" OR TargetObject="*\\Chromium\\Extensions\\*" OR TargetObject="*\\Mozilla\\Firefox\\Extensions\\*" OR TargetObject="*\\NativeMessagingHosts\\*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(registry.path) LIKE "*\\\\policies\\\\google\\\\chrome\\\\extensioninstallforcelist\\\\*" OR TO_LOWER(registry.path) LIKE "*\\\\policies\\\\google\\\\chrome\\\\extensionsettings\\\\*" OR TO_LOWER(registry.path) LIKE "*\\\\policies\\\\microsoft\\\\edge\\\\extensioninstallforcelist\\\\*" OR TO_LOWER(registry.path) LIKE "*\\\\policies\\\\microsoft\\\\edge\\\\extensionsettings\\\\*" OR TO_LOWER(registry.path) LIKE "*\\\\policies\\\\bravesoftware\\\\brave\\\\extensioninstallforcelist\\\\*" OR TO_LOWER(registry.path) LIKE "*\\\\google\\\\chrome\\\\extensions\\\\*" OR TO_LOWER(registry.path) LIKE "*\\\\microsoft\\\\edge\\\\extensions\\\\*" OR TO_LOWER(registry.path) LIKE "*\\\\chromium\\\\extensions\\\\*" OR TO_LOWER(registry.path) LIKE "*\\\\mozilla\\\\firefox\\\\extensions\\\\*" OR TO_LOWER(registry.path) LIKE "*\\\\nativemessaginghosts\\\\*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,registry_set,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetObject" type="pcre2">(?i)(\\Policies\\Google\\Chrome\\ExtensionInstallForcelist\\|\\Policies\\Google\\Chrome\\ExtensionSettings\\|\\Policies\\Microsoft\\Edge\\ExtensionInstallForcelist\\|\\Policies\\Microsoft\\Edge\\ExtensionSettings\\|\\Policies\\BraveSoftware\\Brave\\ExtensionInstallForcelist\\|\\Google\\Chrome\\Extensions\\|\\Microsoft\\Edge\\Extensions\\|\\Chromium\\Extensions\\|\\Mozilla\\Firefox\\Extensions\\|\\NativeMessagingHosts\\)</field>    <description>Browser extension registered or force-installed via registry</description>    <mitre>      <id>T1176</id>    </mitre>  </rule></group>

At a glance

Logsource: registry_set / windows
Level: medium
Category: browser_credential_theft
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 3b7c1e4a-9d62-4f18-a0c5-27e6b8d413f9

ATT&CKT1176

T1176Software Extensions

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 6 fired

Fires on none of the 6 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 6 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1176, evaluated against their registry_set events.

Using it

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Drop the trailing backslash from both ExtensionSettings patterns first. It is
Baseline on the extension ID inside the key path, not on the key prefix.
Use MITRE's Image and ParentImage knobs to separate the writer: the policy
Cover the real blind spot with other rules. The commonest out-of-UI install is a

Declared by the author

Group Policy or an MDM agent pushing an approved extension force-list, which rewrites the whole numbered list on every policy refresh and so re-fires on a schedule. The write comes from the policy client or the management agent, and MITRE names Image and RegistryPath as the knobs — baseline the approved extension IDs rather than the key prefix.
Browser installers and updaters registering bundled or recommended extensions under \Google\Chrome\Extensions\ and \Microsoft\Edge\Extensions\ at each version bump. MITRE's ParentImage knob covers this — the writing process is the vendor updater rather than a script.
Password managers, endpoint agents and conferencing clients that register their own browser extension and a NativeMessagingHosts entry during installation. These are indistinguishable from the malicious case on TargetObject alone, which is why the extension ID in the key path has to be allow-listed.

Lessonbrowser credential theft

browser credential theftAI draft — unreviewed

01 · What this rule detects

A registry value written to a key that enrols a browser extension from outside the browser's own UI. MITRE's analytic AN0251 wants the install correlated with "abnormal registry entries or outbound network connections from the host application" inside a tunable TimeWindow. Sigma cannot join two events, so the network half is deliberately absent and this is the install-side precursor only. That is the familiar trade in this corpus. The less familiar one — and the more important lesson here — is that the registry is not where most malicious extensions actually land.

02 · Telemetry you need

Sysmon EventID 13 (registry_set). TargetObject is the field carrying the
A Sysmon config whose RegistryEvent filters include these key families.
To cover the gap this rule leaves: Sysmon EventID 11 for the browser profile

03 · How the logic works

One selection, one field, ten substrings, three key families:

Family one, the enterprise policy keys. ExtensionInstallForcelist installs an extension the user cannot remove; ExtensionSettings does the same through a JSON policy. Family two, the external-extension keys (…\Chrome\Extensions\<id>), which register an extension for install. Family three, `NativeMessagingHosts`, which is not an install at all — it gives an already-present extension a local executable to talk to, and so is the bridge from browser sandbox to host. Watching it alongside the install keys is a good instinct. contains rather than startswith is correct here: the same policy path appears under both HKLM\SOFTWARE\Policies\… and HKLM\SOFTWARE\WOW6432Node\Policies\…, and NativeMessagingHosts appears under several vendor prefixes. Anchoring at the start would require enumerating every hive-and-prefix combination. The trailing backslash is where it goes wrong, and this is the detail to take away. '\Policies\Google\Chrome\ExtensionSettings\' requires something below the key. ExtensionSettings is most commonly deployed as a single REG_SZ JSON blob at HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionSettings — Sysmon then reports TargetObject ending at …\ExtensionSettings with no trailing separator, and the pattern misses it. That blob is exactly where an adversary writes {"<id>": {"installation_mode": "force_installed", "update_url": "https://attacker/…"}}. The per-extension subkey form (…\ExtensionSettings\<id>\installation_mode) does match — which is why this looks fine in a lab and fails in an Intune-managed estate. One character of over-specification surrenders the richest force-install form in its commonest shape. Two more honest limits. The reviewer notes that on current Chrome and Edge the local-CRX path variant of the …\Extensions\<id> key is no longer honoured; only an update_url pointing at the Web Store works, so that key registers a Web Store install rather than side-loading an arbitrary CRX. And T1176 is Software Extensions — AN0251 names IDE extensions explicitly. VS Code and JetBrains plugin persistence (%USERPROFILE%\.vscode\extensions) is out of scope here with no acknowledgement in the rule, so a T1176 tag reads as complete coverage of roughly half the technique.

04 · Common false positives

Group Policy and MDM rewriting the whole numbered force-list on **every policy
Browser installers and updaters registering bundled extensions under
NativeMessagingHosts is louder than the rule's false positives suggest. They

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0092 and never executed against a log line. level: medium is a judgement, not a measurement. Note also that translations.json records a Sentinel refusal: no table is modelled for registry_set/windows, so three backends render and one honestly declines rather than emitting KQL that would match nothing.
tier_2: confirm your Sysmon config actually captures these keys, run the rule over historical data, and turn your approved extension IDs and management agents into named exclusions.
tier_3: needs MITRE's TimeWindow — install joined to first outbound connection from the browser — which is correlation this YAML cannot hold.

Related detections1 nearby

Browser writing executable content outside its download folder

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/3b7c1e4a-9d62-4f18-a0c5-27e6b8d413f9

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Browser extension registered or force-installed via registry

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it