MITRE ATT&CK technique · Persistence

`T1176.001` Browser Extensions

Sub-technique of T1176 Software Extensions

Adversaries may abuse internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality to and customize aspects of internet browsers. They can be installed directly via a local file or custom URL or through a browser's app store - an official online platform where users can browse, install, and manage…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

Lumma Stealer

Sigma rules to hunt it

Suspicious Chromium Browser Instance Executed With Custom Extensionhightest · windows
Chromium Browser Instance Executed With Custom Extensionmediumtest · windows

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.