Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1176.001_browser-extensions
Adversaries may abuse internet browser extensions to establish persistent access to victim systems.
Passed 19 of 22 test cases with the skill, and 15 of 22 without it.
and 3 more in the full report
6 fixed13 passed either way1 still failing2 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
Our CISO wants a strict policy control list for browser extensions using enterprise administrative templates. Which MITRE mitigation control ID specifies defining allow lists or deny lists for browser extensions?
| Checked | Without skill | With skill |
|---|---|---|
| References M1038 Execution Prevention. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1176
Adversaries may abuse internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality to and customize aspects of internet browsers. They can be installed directly via a local file or custom URL or through a browser's app store - an official online platform where users can browse, install, and manage extensions for a specific web browser. Extensions generally inherit the web browser's permissions previously granted.
Malicious extensions can be installed into a browser through malicious app store downloads masquerading as legitimate extensions, through social engineering, or by an adversary that has already compromised a system. Security can be limited on browser app stores, so it may not be difficult for malicious extensions to defeat automated scanners. Depending on the browser, adversaries may also manipulate an extension's update url to install updates from an adversary-controlled server or manipulate the mobile configuration file to silently install additional extensions.
Adversaries may abuse how chromium-based browsers load extensions by modifying or replacing the Preferences and/or Secure Preferences files to silently install malicious extensions. When the browser is not running, adversaries can alter these files, ensuring the extension is loaded, granted desired permissions, and will persist in browser sessions. This method does not require user consent and extensions are silently loaded in the background from disk or from the browser's trusted store.
Previous to macOS 11, adversaries could silently install browser extensions via the command line using the profiles tool to install malicious .mobileconfig files. In macOS 11+, the use of the profiles tool can no longer install configuration profiles; however, .mobileconfig files can be planted and installed with user interaction.
Once the extension is installed, it can browse to websites in the background, steal all information that a user enters into a browser (including credentials), and be used as an installer for a RAT for persistence.
There have also been instances of botnets using a persistent backdoor through malicious Chrome extensions for Command and Control. Adversaries may also use browser extensions to modify browser permissions and components, privacy settings, and other security controls for Defense Evasion.
Platforms: Linux, Windows, macOS
Identify Attack Surface: Determine if the target environment is susceptible to Browser Extensions by examining the target platforms (Linux, Windows, macOS).
Assess Existing Defenses: Review whether mitigations for T1176.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
test cases passed, vs 15 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.