Software Extensions

When a detection for this fires

What the technique is

Adversaries may abuse software extensions to establish persistent access to victim systems. Software extensions are modular components that enhance or customize the functionality of software applications, including web browsers, Integrated Development Environments (IDEs), and other platforms. Extensions are typically installed via official marketplaces, app stores, or manually loaded by users, and they often inherit the permissions and access levels of the host application. Malicious extensions can be introduced through various methods, including social engineering, compromised marketplaces, or direct installation by users or by adversaries who have already gained access to a system. Malicious extensions can be named similarly or identically to benign extensions in marketplaces. Security mechanisms in extension marketplaces may be insufficient to detect malicious components, allowing adversaries to bypass automated scanners or exploit trust established during the installation process. Adversaries may also abuse benign extensions to achieve their objectives, such as using legitimate functionality to tunnel data or bypass security controls. The modular nature of extensions and their integration with host applications make them an attractive target for adversaries seeking to exploit trusted software ecosystems. […]

What MITRE says you would watch

• AN0251

  Installation or execution of a malicious browser or IDE extension, followed by abnormal registry entries or outbound network connections from the host application

• AN0252

  Installation of configuration profiles or plist entries associated with malicious or unauthorized browser extensions

• AN0253

  Manual or script-based installation of extension-like modules into browser config directories or IDE plugin paths, followed by suspicious network activity