AN0251
Analytic 0251
Windows
Installation or execution of a malicious browser or IDE extension, followed by abnormal registry entries or outbound network connections from the host application
WinEventLog:Security
EventCode=4688
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=13, 14
WinEventLog:Sysmon
EventCode=3, 22
[Image]
Path of browser or IDE launching subprocesses—may vary depending on installed applications
[ParentImage]
Legitimate parent-child process relationships for known safe extensions
[RegistryPath]
Expected registry keys under HKCU/HKLM for installed extensions
[TimeWindow]
Tunable interval to correlate extension install with follow-on C2 traffic
AN0252
Analytic 0252
macOS
Installation of configuration profiles or plist entries associated with malicious or unauthorized browser extensions
macos:unifiedlog
Execution of 'profiles install -type=configuration'
macos:unifiedlog
Creation of .plist under /Library/Managed Preferences/
macos:unifiedlog
Suspicious outbound traffic from browser binary to non-standard domains
[PlistPath]
Directory path for user-specific extension configuration files
[CommandLine]
Usage of profiles CLI tool—can be modified by legitimate tools or MDMs
[TimeWindow]
Correlation window between configuration install and observable extension behavior
AN0253
Analytic 0253
Linux
Manual or script-based installation of extension-like modules into browser config directories or IDE plugin paths, followed by suspicious network activity
auditd:SYSCALL
execve
fs:fileevents
creat
NSM:Flow
Abnormal browser traffic volume or destination
[DirectoryPath]
Common plugin or extension directories may vary by distro or browser (e.g., ~/.config/google-chrome/Default/Extensions)
[ExecPath]
Path to scripting tools used in installation (e.g., bash, curl, unzip)
[TimeWindow]
Tunable interval between install and first network beacon