1200KM / detection
T1176.001 Browser Extensions — Detection Rules
Detection workspace for T1176.001 Browser Extensions: 2 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- Chromium Browser Instance Executed With Custom Extension · test · medium · {"category":"process_creation","product":"windows"}
- Suspicious Chromium Browser Instance Executed With Custom Extension · test · high · {"category":"process_creation","product":"windows"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0044 Detecting Malicious Browser Extensions Across Platforms
AN0123 Analytic 0123
Installation of a new browser extension followed by suspicious file writes or outbound network connections to untrusted domains by the browser process.
AN0124 Analytic 0124
Installation of malicious .mobileconfig profiles or browser extension plist entries followed by abnormal browser child process activity.
AN0125 Analytic 0125
Manual or scripted installation of Chrome extensions using user scripts or config files, followed by unexpected network connections from browser processes.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1176.001 simulation workspace
- Command Execution · DC0064
- File Access · DC0055
- File Creation · DC0039
- Network Connection Creation · DC0082
- Network Traffic Content · DC0085
- Process Creation · DC0032
- Windows Registry Key Modification · DC0063
No reviewed association in this snapshot.
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.