Software Extensions T1176
Tactic: Persistence
Adversaries may abuse software extensions to establish persistent access to victim systems. Software extensions are modular components that enhance or customize the functionality of software applications, including web browsers, Integrated Development Environments (IDEs), and other platforms. Extensions are typically installed via official marketplaces, app stores, or manually loaded by users, and they often inherit the permissions and access levels of the host application.
Events covered
9 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Sysmon | Event ID 11 | FileCreate |
| Sysmon | Event ID 12 | RegistryEvent (Object create and delete) |
| Sysmon | Event ID 13 | RegistryEvent (Value Set) |
| Sysmon | Event ID 14 | RegistryEvent (Key and Value Rename) |
| Security-Auditing | Event ID 4688 | A new process has been created. |
| Defender-DeviceInfo | any | Device information |
| ESF | exec | Process Execution |
| ESF | write | File Write |
Authoring guide
These 15 rules share fields, values, and exclusions.
Fields filtered most (23 distinct)
These fields appear most often in rule filters.
Top indicator values (134 distinct)
These values appear most often in rule predicates.
Exclusions (100 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 3 rules
- ChromeLoader Malware Execution
- Chromium Browser Instance Executed With Custom Extension
- Suspicious Chromium Browser Instance Executed With Custom Extension
Elastic 8 rules
- Browser Extension Install
- Browser Native Messaging Registry Modification
- Chromium Extension Loaded from Unusual Parent
- Manual Loading of a Suspicious Chromium Extension
- Suspicious Browser Files Modification
- Suspicious Browser Preference File Modification
- Suspicious Browser Preferences File Modification
- Uncommon Registry Persistence Change