T1176: Software Extensions
Adversaries may abuse software extensions to establish persistent access to victim systems. Software extensions are modular components that enhance or customize the functionality of software applications, including web browsers, Integrated Development Environments (IDEs), and other platforms.[1][2] Extensions are typically installed via official marketplaces, app stores, or manually loaded by users, and they often inherit the permissions and access levels of the host application.
Malicious extensions can be introduced through various methods, including social engineering, compromised marketplaces, or direct installation by users or by adversaries who have already gained access to a system. Malicious extensions can be named similarly or identically to benign extensions in marketplaces. Security mechanisms in extension marketplaces may be insufficient to detect malicious components, allowing adversaries to bypass automated scanners or exploit trust established during the installation process. Adversaries may also abuse benign extensions to achieve their objectives, such as using legitimate functionality to tunnel data or bypass security controls.
The modular nature of extensions and their integration with host applications make them an attractive target for adversaries seeking to exploit trusted software ecosystems. Detection can be challenging due to the inherent trust placed in extensions during installation and their ability to blend into normal application workflows.
Analyst context for executives and security teams
Software extensions matter because they sit inside trusted applications such as browsers and IDEs and may inherit those applications’ permissions. That makes them a practical persistence risk across Windows, macOS, and Linux: a malicious or abused extension can blend into normal user and developer workflows, especially when installed from a marketplace or loaded manually.
Executive priority
Treat extension governance as part of endpoint, identity, developer workstation, and compliance readiness. Leaders should ask whether the organization knows which browser and IDE extensions are installed, who can install them, how approvals are enforced, and whether audits can prove unauthorized extensions are found and removed. This is especially important for workstations handling sensitive data, code, credentials, or privileged cloud access.
Technical view
This is an enterprise persistence technique with browser and IDE extension sub-techniques. SOC and IR teams should validate visibility into extension inventories, installation events, extension update/change activity, host application permissions, and suspicious extension behavior. Because MITRE provides no official detection text for this object, detection engineering should start from the related strategy DET0092, Detection of Malicious or Unauthorized Software Extensions, and test it against both browser extension and IDE extension use cases.
Likely telemetry
- Browser extension inventories and configuration state
- IDE extension inventories and configuration state
- Endpoint management or software inventory records
- Application allowlist or restriction policy events
- User-driven installation or manual load events where available
Detection direction
- Build baselines of approved extensions for high-risk user groups, including developers and privileged users.
- Alert or review newly installed, manually loaded, renamed, or unexpected extensions, especially when they resemble common benign extensions.
- Correlate extension changes with unusual browser or IDE network activity, credential access concerns, or persistence investigation timelines.
- Account for false positives from legitimate user customization, developer tooling, and sanctioned productivity extensions.
- Validate coverage separately for browser extensions and IDE extensions because the sub-techniques may produce different telemetry.
Mitigation priorities
- Limit software and extension installation rights using approved software processes and least privilege.
- Use execution prevention and application control where applicable to reduce unauthorized code execution through trusted applications.
- Maintain software updates for host applications and extension ecosystems to reduce exposure to known weaknesses.
- Run periodic audits of installed extensions and compare results against approved business needs.
- Train users and developers to recognize suspicious extensions, lookalike names, and risky marketplace trust assumptions.
Analyst notes and limits
The supplied ATT&CK object emphasizes persistence through modular software extensions and includes browser and IDE extension sub-techniques. The most useful defensive question is not only whether malware is detected, but whether the organization can inventory, approve, monitor, and audit extensions inside trusted applications.
MITRE does not provide official detection guidance for this technique in the supplied fields. This take is therefore based on the official description, external references, and relationship context only. Local validation is required to determine which browsers, IDEs, endpoints, logs, and controls are actually present.
Software Extensions
Adversaries may abuse software extensions to establish persistent access to victim systems. Software extensions are modular components that enhance or customize the functionality of software applications, including web browsers, Integrated Development Environments (IDEs), and other platforms.[1][2] Extensions are typically installed via official marketplaces, app stores, or manually loaded by users, and they often inherit the permissions and access levels of the host application.
Malicious extensions can be introduced through various methods, including social engineering, compromised marketplaces, or direct installation by users or by adversaries who have already gained access to a system. Malicious extensions can be named similarly or identically to benign extensions in marketplaces. Security mechanisms in extension marketplaces may be insufficient to detect malicious components, allowing adversaries to bypass automated scanners or exploit trust established during the installation process. Adversaries may also abuse benign extensions to achieve their objectives, such as using legitimate functionality to tunnel data or bypass security controls.
The modular nature of extensions and their integration with host applications make them an attractive target for adversaries seeking to exploit trusted software ecosystems. Detection can be challenging due to the inherent trust placed in extensions during installation and their ability to blend into normal application workflows.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1176.002 | IDE Extensions Sub-technique | IDE Extensions subtechnique of this object. |
| Enterprise | T1176.001 | Browser Extensions Sub-technique | Browser Extensions subtechnique of this object. |
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 2.0 | Current bundle | b37f8286cbcb… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Chrome Extension C2 Malware
Kjaer, M. (2016, July 18). Malware in the browser: how you might get hacked by a Chrome extension. Retrieved September 12, 2024.
Open source URL -
[2]
Abramovsky VSCode Security
Abramovsky, O. (2023, May 16). VSCode Security: Malicious Extensions Detected- More Than 45,000 Downloads- PII Exposed, and Backdoors Enabled. Retrieved March 30, 2025.
Open source URL -
[3]
mitre-attack T1176Open source URL
-
[4]
xorrior chrome extensions macOS
Chris Ross. (2019, February 8). No Place Like Chrome. Retrieved April 27, 2021.
Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.