TA0003 · PERSISTENCE
Software Extensions
Adversaries may abuse software extensions to establish persistent access to victim systems.
Detect it with
Inventory and monitor browser extension installations that deviate from normal, expected, and benign extensions. Process and network monitoring can be used to detect browsers communicating with a C2 server.
Why it matters on shift
Software Extensions is one of the concrete ways adversaries achieve persistence. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After persistence, the next tactic is usually Privilege Escalation. Search your telemetry for the transition before closing the ticket.
2 sub-techniques
How it shows up in practice
- T1176.001
Browser Extensions
Adversaries may abuse internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality to and customize aspects of internet browsers.
- T1176.002
IDE Extensions
Adversaries may abuse an integrated development environment (IDE) extension to establish persistent access to victim systems.
Kill-chain context