T1176.001 — Browser Extensions

Tactic: Persistence · Platforms: Linux, Windows, macOS

Adversaries may abuse internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality to and customize aspects of internet browsers. They can be installed directly via a local file or custom URL or through a…

Sub-technique of Software Extensions (T1176).

Sigma detection rules (3)

title: "T1176.001 Software Extensions: Browser Extensions"
id: f4b3af81-d4a9-4ef1-88d8-1b21d4f0c0a0
description: 'Detecting Malicious Browser Extensions Across Platforms. (Retargeted from the original process_creation label to file_event — this is the telemetry source that actually captures this technique''s behavior; see logsource below.) Tune using: UserContext, BrowserExecutablePath, ExtensionInstallPath.'
references:
  - https://attack.mitre.org/techniques/T1176/001
author: Shahrukh Khan
date: 2026-01-15
license: MIT
tags:
  - attack.persistence
  - attack.t1176.001

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    TargetFilename|contains:
      - '\Google\Chrome\User Data\Default\Extensions\'
      - '\Microsoft\Edge\User Data\Default\Extensions\'
    TargetFilename|endswith: '.crx'

  condition: selection

falsepositives:
  - Legitimate browser-extension installation by the user from an official web store.

level: medium

title: "T1176.001 Software Extensions: Browser Extensions"
id: 5fbf062c-e46b-4035-875e-fbf72663ab3e
description: 'Detects filesystem writes to browser extension-loading locations and profile Preferences/Secure Preferences files, which Chromium-based browsers use to silently load or grant permissions to extensions without user consent. (Retargeted from process_creation to the file_event auditd PATH telemetry that actually captures this behavior.) Tune using: ExtensionDir, DomainWatchlist.'
references:
  - https://attack.mitre.org/techniques/T1176/001
author: Shahrukh Khan
date: 2026-05-03
license: MIT
tags:
  - attack.persistence
  - attack.t1176.001

logsource:
  category: file_event
  product: linux
  service: auditd

detection:
  selection_extension_dir:
    type: PATH
    name|contains: '/Extensions/'
    nametype:
      - CREATE
      - NORMAL
  selection_preferences_file:
    type: PATH
    name|contains:
      - '/Preferences'
      - '/Secure Preferences'
    nametype:
      - CREATE
      - NORMAL
  selection_browser_profile:
    name|contains:
      - '/.config/google-chrome/'
      - '/.config/chromium/'
      - '/.config/microsoft-edge/'
      - '/.mozilla/firefox/'

  condition: (selection_extension_dir or selection_preferences_file) and selection_browser_profile

falsepositives:
  - Legitimate extension installs, browser sync, and profile/version updates create the same directory-write and Preferences-file-write pattern; domain-watchlist correlation for the extension source still can't be derived from filesystem events alone.

level: low

title: "T1176.001 Software Extensions: Browser Extensions"
id: 6bce8909-1497-448a-9013-c95e20b1179d
description: 'Detecting Malicious Browser Extensions Across Platforms. (Retargeted to the file_event macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: PlistPath, CommandLineFlags.'
references:
  - https://attack.mitre.org/techniques/T1176/001
author: Shahrukh Khan
date: 2026-02-01
license: MIT
tags:
  - attack.persistence
  - attack.t1176.001

logsource:
  category: file_event
  product: macos

detection:
  selection:
    TargetFilename|contains:
      - '/Library/Safari/Extensions/'
      - '/Application Support/Google/Chrome/'
    TargetFilename|endswith:
      - '.appex'
      - '.crx'

  condition: selection

falsepositives:
  - Users installing legitimate browser extensions from official stores create the same file artifacts.

level: medium

Related sub-techniques

• T1176.002 IDE Extensions

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1176.001 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan