Detect browser launched with a sideloaded extension flag

Siemphony@siemphonymediumT1176.001unverifiedPlaybook · Credential theft

Matches process creation where the command line carries a Chromium extension-sideloading switch — the unpacked-extension load path an adversary uses to install a browser extension from a local directory without going through the web store. The match is on CommandLine alone rather than on the browser image: MITRE's BrowserExecutablePath knob warns that custom and portable browsers do not sit at default paths, and these switches are browser-specific enough to stand on their own. The rest of the analytic — the file writes and outbound connections that follow the install — is a correlation Sigma cannot express, so this rule covers the install event only. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0044, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Detect browser launched with a sideloaded extension flag2id: 93c9e97b-4861-4042-9b15-38c1d0ee87fa3status: experimental4description: |5  Matches process creation where the command line carries a Chromium6  extension-sideloading switch — the unpacked-extension load path an adversary7  uses to install a browser extension from a local directory without going8  through the web store. The match is on CommandLine alone rather than on the9  browser image: MITRE's BrowserExecutablePath knob warns that custom and10  portable browsers do not sit at default paths, and these switches are11  browser-specific enough to stand on their own. The rest of the analytic —12  the file writes and outbound connections that follow the install — is a13  correlation Sigma cannot express, so this rule covers the install event only.14  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0044, not hand-written and not tested by its author. Any lab result is on this rule's own page.15references:16  - https://attack.mitre.org/techniques/T1176/00117  - https://attack.mitre.org/detectionstrategies/DET004418author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)19date: 2026-08-1620tags:21  - attack.persistence22  - attack.t1176.00123logsource:24  category: process_creation25  product: windows26detection:27  selection:28    CommandLine|contains:29      - '--load-extension='30      - '--disable-extensions-except='31      - '--pack-extension='32      - '--install-chrome-app='33  condition: selection34falsepositives:35  - "Extension developers. Loading an unpacked extension from a working directory is the normal development loop, so on engineering endpoints this fires constantly. MITRE's UserContext knob is the tuning point — reserve the alert for accounts that have no business developing extensions, or exclude command lines whose extension path sits under a known source tree."36  - "Automated browser testing. Selenium, Puppeteer and Playwright launch Chromium with '--load-extension=' and '--disable-extensions-except=' pointing at a temporary profile directory; the ExtensionInstallPath knob is where that temp-directory prefix gets excluded."37  - "Packaging steps in a build pipeline that call '--pack-extension=' to produce a signed .crx as a release artefact."38level: medium

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (ProcessCommandLine contains "--load-extension=" or ProcessCommandLine contains "--disable-extensions-except=" or ProcessCommandLine contains "--pack-extension=" or ProcessCommandLine contains "--install-chrome-app=")

Splunk · SPL

Run this as a search.

index=* (CommandLine="*--load-extension=*" OR CommandLine="*--disable-extensions-except=*" OR CommandLine="*--pack-extension=*" OR CommandLine="*--install-chrome-app=*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.command_line) LIKE "*--load-extension=*" OR TO_LOWER(process.command_line) LIKE "*--disable-extensions-except=*" OR TO_LOWER(process.command_line) LIKE "*--pack-extension=*" OR TO_LOWER(process.command_line) LIKE "*--install-chrome-app=*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(--load-extension=|--disable-extensions-except=|--pack-extension=|--install-chrome-app=)</field>    <description>Detect browser launched with a sideloaded extension flag</description>    <mitre>      <id>T1176.001</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: browser_credential_theft
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 93c9e97b-4861-4042-9b15-38c1d0ee87fa

ATT&CKT1176.001

T1176.001Browser Extensions

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1176.001, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Pair this rule with the coverage it is missing, rather than tightening it.
Apply MITRE's UserContext knob: reserve the alert for accounts with no
Use ExtensionInstallPath to exclude your test frameworks' temp-profile
Consider an Image constraint after all, if your estate has no

Declared by the author

Extension developers. Loading an unpacked extension from a working directory is the normal development loop, so on engineering endpoints this fires constantly. MITRE's UserContext knob is the tuning point — reserve the alert for accounts that have no business developing extensions, or exclude command lines whose extension path sits under a known source tree.
Automated browser testing. Selenium, Puppeteer and Playwright launch Chromium with '--load-extension=' and '--disable-extensions-except=' pointing at a temporary profile directory; the ExtensionInstallPath knob is where that temp-directory prefix gets excluded.
Packaging steps in a build pipeline that call '--pack-extension=' to produce a signed .crx as a release artefact.

Lessonbrowser credential theft

browser credential theftAI draft — unreviewed

01 · What this rule detects

A process creation event whose command line carries one of four Chromium extension switches: --load-extension=, --disable-extensions-except=, --pack-extension= or --install-chrome-app=. These are the sideloading path — they install or stage an extension from a local directory rather than the web store, so no store review, no publisher, no consent dialogue. MITRE's AN0123 describes an install followed by suspicious file writes or outbound connections from the browser. Sigma cannot join those, so this rule covers the install moment alone.

02 · Telemetry you need

category: process_creation, product: windows — verbatim from AN0123's
CommandLine is the only field this rule reads, and on Security 4688 it is

03 · How the logic works

One field, four substrings, ORed. Note what is not here: no constraint on Image at all. The description defends that on MITRE's BrowserExecutablePath knob — "custom or portable browsers may not match default paths" — and the switches are distinctive enough to stand alone. The cost is that the rule matches the string, anywhere, in any command line. cmd.exe /c start chrome --load-extension=… produces two matching events (the cmd and the chrome), and a wrapper script, a deployment tool passing browser flags through, or a findstr over a config file alerts identically. Read a hit as "a command line mentioned this switch", not "a browser launched". --disable-extensions-except= is not itself an install switch — it keeps the sideloaded extension running while suppressing everything else, and it is what automation frameworks pair with --load-extension=. --pack-extension= is build-time packaging rather than install, which is why the rule's third false positive is a CI pipeline. Attribution: the four switches are real Chromium switches and they are the author's. MITRE supplied no flag list at all — AN0123's knobs are UserContext, BrowserExecutablePath and ExtensionInstallPath, three names describing where tuning belongs, with no values under them.

04 · Common false positives

Extension developers, for whom loading an unpacked extension from a
Automated browser testing — Selenium, Puppeteer and Playwright launch
RPA and enterprise agents — UiPath, Power Automate Desktop, Blue Prism —

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0044 and never executed against a log line. level: medium is an estimate, and it is arguably the right altitude given how much of the volume will be automation.
tier_2: means running it and finding out how much of your fleet is on Chromium 137 or later — on those hosts a match means something different from what the description implies.
tier_3: means the forcelist and profile rules above, so the attack.persistence tag is carried by logic that actually detects persistence, with this rule kept alongside as the session-only sideload signal it is.

Related detections1 nearby

IDE extension side-loaded from a local package file

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/93c9e97b-4861-4042-9b15-38c1d0ee87fa

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Detect browser launched with a sideloaded extension flag

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it