Browser hijacker
Alters browser homepage/search settings to inject ads or redirects
categoryMalwareseverityLowdetectability (measured in our lab)Lowlabpartially detected
Example: CoolWebSearch
Detection opportunity what to watch for
A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.
What the attacker runs
sudo /opt/lab/detonate.sh --technique T1176 --tool atomic --run-id run-2026-10-20-002 -- pwsh -c 'Import-Module invoke-atomicredteam; Invoke-AtomicTest T1176 -TestGuids 3ecd790d-2617-4abf-9a8c-4e8d47da9ee1 -PathToAtomicsFolder /opt/AtomicRedTeam/atomics -TimeoutSeconds 120'What our lab measured
partially detected linux · 2026-10-20
Plus 3 stock Wazuh/Sysmon rule(s) in the window.
Background noise in the window: ~198 incidental alerts/hour — tune against this.
Classification
26 values: 2 lab-measured, 11 imported, 1 derived, 12 machine-classified. What do these mean?
Exploitability
| Attack vector | Malware |
|---|---|
| Reach (CVSS) | Local |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Active |
| Attacker skill required | Low |
| Resources required | Low |
| Likelihood / prevalence | High |
| Maturity | Commoditized |
Impact & scope
| Severity | Low |
|---|---|
| Impact | Integrity |
| Platform | LinuxmacOSWindows |
| Environment | On-premises |
| Target asset class | Endpoint |
| Kill-chain phase (tactic) | Persistence |
Detection & telemetry
| Detectability (measured in our lab) | Low |
|---|---|
| Detectability (public detection content) | Medium |
| Noise level | High |
| Testability | Atomic Red Team test |
| Data sources (ATT&CK data components) | Command ExecutionFile CreationNetwork Connection CreationNetwork Traffic FlowProcess CreationWindows Registry Key Modification |
Detection & response
Mitigated by 9
- M1017 attack-mitigation
- M1033 attack-mitigation
- M1038 attack-mitigation
- M1047 attack-mitigation
- M1051 attack-mitigation
D3-AVEd3fendD3-RSd3fendD3-SUd3fendD3-SWId3fend
Detected by 4
- DET0092 attack-detection-strategy
0a74c5a9-1b71-4475-9af2-7829d320d5c2sigma27ba3207-dd30-4812-abbf-5d20c57d474esigma88d6e60c-759d-4ac1-a447-c0f1466c2d21sigma
Tested by 4
3d456e2b-a7db-4af8-b5b3-720e7c4d9da5atomic3ecd790d-2617-4abf-9a8c-4e8d47da9ee1atomic7a714703-9f6b-461c-b06d-e6aeac650f27atomiccb790029-17e6-4c43-b96f-002ce5f10938atomic
Attack relationships
Lab findings
Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.
| Run | Outcome | Tool | Platform | Ran at |
|---|---|---|---|---|
run-2026-10-20-002 | partially-detected | atomic | linux | 2026-10-20 |
run-2026-10-20-002— Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=4). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1176 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=5 max_level=3 dwell_s=90
Framework references
- Primary source: https://www.malwarebytes.com/glossary
- attack: T1176 (primary)
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Malware' table, line 106 of Cyber-Attack-Taxonomy.md
- ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1176 as the nearest framework entries; ids verified to exist in the cached catalogues.
- ev-0003 (Phase 4 detection lab - detonation runs 2026-10-20) — Lab detonation run-2026-10-20-002 (partially-detected) for T1176: no alert matched the expected technique