Detecting and Mitigating Malicious Browser Extensions (T1176.001)

A browser extension can read pages, see sessions and run every time the browser starts. T1176.001, Browser Extensions, is the sub-technique of Software Extensions where an adversary abuses that to keep access. MITRE files it under persistence for Linux, macOS and Windows.

How attackers use it

Extensions are small programs that add features to a browser. They can be installed from a local file, from a custom URL, or through the browser's app store. They generally inherit the permissions the browser already has.

MITRE lists several ways a malicious one lands:

• Store downloads and social engineering. A malicious extension masquerades as a legitimate one in the app store, or a user is talked into installing it. Store security can be limited, so defeating automated scanners may not be hard.
• Post-compromise install. An adversary who already controls a system installs it.
• Update URL manipulation. Depending on the browser, an adversary may change an extension's update URL so updates come from an adversary-controlled server.
• Configuration profiles. On macOS, adversaries may manipulate the mobile configuration file to silently install extra extensions. MITRE notes that before macOS 11, the profiles tool could install malicious .mobileconfig files from the command line, and that later versions of macOS changed this.
• Preferences files. Chromium-based browsers load extensions according to the Preferences and Secure Preferences files. When the browser is not running, an adversary can alter or replace them so a malicious extension loads with the permissions it wants and persists across sessions. This needs no user consent, and the extension loads silently from disk or from the trusted store.

The MITRE page lists Grandoreiro, Lumma Stealer and Kimsuky among users of the technique.

How to detect it

MITRE's detection strategy has a variant per platform.

• Windows. Installation of a new extension, followed by suspicious file writes or outbound connections to untrusted domains from the browser process.
• macOS. Installation of malicious .mobileconfig profiles or browser extension plist entries, followed by abnormal browser child process activity.
• Linux. Manual or scripted installation of Chrome extensions using user scripts or config files, followed by unexpected network connections from browser processes.

Signals you can collect without special tooling:

1. A change to an extension folder or to Preferences and Secure Preferences while the browser is closed.
2. A browser process making network connections to domains it never used before.
3. A browser launching child processes. Browsers rarely start shells.
4. A new configuration profile on a Mac that your device management did not push.

File creation events (Sysmon event ID 11 on Windows) on the extensions folder and network connection events (Sysmon event ID 3) from the browser process cover the first two.

How to reduce the risk

MITRE lists five mitigations.

1. Limit installation. Only install browser extensions from trusted sources that can be verified. For some browsers, extensions can be controlled through Group Policy, so set the browser to block installs without sufficient permissions.
2. Audit. Make sure the installed extensions are the intended ones, since many malicious extensions masquerade as legitimate ones.
3. Update software. Keep operating systems and browsers current.
4. Train users. Close all browser sessions when finished, so a malicious extension cannot keep running.
5. Set an allow list or deny list of extensions that fits your security policy.

An allow list is the strongest of these. If only approved extension IDs can install, a silent install of anything else fails.

Check your own environment

In Chrome, open chrome://extensions to see what is installed and chrome://policy to see which policies apply.

To list extension folders (each folder name is an extension ID), read-only:

Windows (PowerShell):

Get-ChildItem "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions" | Select-Object Name, LastWriteTime

macOS:

ls -la ~/Library/Application\ Support/Google/Chrome/Default/Extensions

Linux:

ls -la ~/.config/google-chrome/Default/Extensions

Then ask:

• Do we have an allow list for extensions on managed browsers?
• Can we list every extension on every managed device from one place?
• Does someone review new extensions and their permissions before approval?
• On Macs, which configuration profiles are installed, and did each one come from us?

Try it yourself

Lookalike extensions work like typosquatted packages: a name that seems right and code that is not. This demo shows how that kind of malware is spotted.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• MITRE ATT&CK, T1176.001 Browser Extensions