Malicious browser / IDE extension
Extension abusing host-app permissions for persistence or data theft
categoryMalwareseverityHighdetectabilityMediumlabnot yet measured
Classification
30 values: 16 reviewed, 13 imported, 1 derived. What do these mean?
Exploitability
| Attack vector | Malware |
|---|---|
| Reach (CVSS) | Local |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Active |
| Attacker skill required | Medium |
| Resources required | Low |
| Likelihood / prevalence | High |
| Maturity | Commoditized |
Impact & scope
| Severity | High |
|---|---|
| Impact | ConfidentialityIntegrity |
| Platform | LinuxmacOSWindows |
| Environment | CloudMobileOn-premises |
| Target asset class | EndpointIdentity |
| Kill-chain phase (tactic) | Persistence |
Detection & telemetry
| Detectability | Medium |
|---|---|
| Data sources (ATT&CK data components) | Command ExecutionFile AccessFile CreationNetwork Connection CreationNetwork Traffic ContentNetwork Traffic FlowProcess CreationWindows Registry Key Modification |
Detection & response
Mitigated by 9
- M1017 attack-mitigation
- M1033 attack-mitigation
- M1038 attack-mitigation
- M1047 attack-mitigation
- M1051 attack-mitigation
D3-AVEd3fendD3-RSd3fendD3-SUd3fendD3-SWId3fend
Detected by 4
- DET0044 attack-detection-strategy
- DET0561 attack-detection-strategy
27ba3207-dd30-4812-abbf-5d20c57d474esigma88d6e60c-759d-4ac1-a447-c0f1466c2d21sigma
Attack relationships
- Parent: Browser hijacker
Framework references
- Primary source: https://attack.mitre.org/techniques/T1176/
- attack: T1176.001 (primary)
- attack: T1176.002
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Malware' table, line 107 of Cyber-Attack-Taxonomy.md
- ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 2 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
- ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 7 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)