T1176 Browser Extensions Mappings

Adversaries may abuse Internet browser extensions to establish persistence access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access. (Citation: Wikipedia Browser Extension) (Citation: Chrome Extensions Definition)

Malicious extensions can be installed into a browser through malicious app store downloads masquerading as legitimate extensions, through social engineering, or by an adversary that has already compromised a system. Security can be limited on browser app stores so it may not be difficult for malicious extensions to defeat automated scanners. (Citation: Malicious Chrome Extension Numbers) Once the extension is installed, it can browse to websites in the background, (Citation: Chrome Extension Crypto Miner) (Citation: ICEBRG Chrome Extensions) steal all information that a user enters into a browser (including credentials) (Citation: Banker Google Chrome Extension Steals Creds) (Citation: Catch All Chrome Extension) and be used as an installer for a RAT for persistence.

There have also been instances of botnets using a persistent backdoor through malicious Chrome extensions. (Citation: Stantinko Botnet) There have also been similar examples of extensions being used for command & control (Citation: Chrome Extension C2 Malware).

View in MITRE ATT&CK®

Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
AC-6 Least Privilege Protects T1176 Browser Extensions
CA-7 Continuous Monitoring Protects T1176 Browser Extensions
CA-8 Penetration Testing Protects T1176 Browser Extensions
CM-11 User-installed Software Protects T1176 Browser Extensions
CM-2 Baseline Configuration Protects T1176 Browser Extensions
CM-3 Configuration Change Control Protects T1176 Browser Extensions
CM-5 Access Restrictions for Change Protects T1176 Browser Extensions
CM-6 Configuration Settings Protects T1176 Browser Extensions
CM-7 Least Functionality Protects T1176 Browser Extensions
RA-5 Vulnerability Monitoring and Scanning Protects T1176 Browser Extensions
SC-7 Boundary Protection Protects T1176 Browser Extensions
SI-10 Information Input Validation Protects T1176 Browser Extensions
SI-3 Malicious Code Protection Protects T1176 Browser Extensions
SI-4 System Monitoring Protects T1176 Browser Extensions
SI-7 Software, Firmware, and Information Integrity Protects T1176 Browser Extensions