T1176 Software Extensions
Adversaries may abuse software extensions to establish persistent access to victim systems. Software extensions are modular components that enhance or customize the functionality of software applications, including web browsers, Integrated Development Environments (IDEs), and other platforms.(Citation: Chrome Extension C2 Malware)(Citation: Abramovsky VSCode Security) Extensions are typically…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- ChromeLoader Malware Executionhightest · windows
- Suspicious Chromium Browser Instance Executed With Custom Extensionhightest · windows
- Chromium Browser Instance Executed With Custom Extensionmediumtest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.