Wiki › Techniques, Tactics & Procedures (TTPs) › Persistence › Browser Extension Persistence

Browser Extension Persistence

2 min read

Jump to:

Overview

Browser Extension Persistence is a technique used by adversaries to maintain long-term access and control within a victim’s environment by leveraging browser extensions. This method plays a critical role in the persistence phase of the attack lifecycle, enabling attackers to survive system reboots, evade detection, and facilitate ongoing operations such as data collection or command execution.

Attack Objective

Establish and maintain persistent access within a target environment
Supports the Persistence stage of the attack lifecycle, with potential impact on Execution and Defense Evasion
Allows attackers to retain foothold, execute malicious code, and maintain communication channels despite system restarts or user logouts

How the Technique Works

Adversaries install or modify browser extensions to embed malicious functionality that activates each time the browser is launched. These extensions can execute scripts, intercept user activity, communicate with command and control servers, or manipulate web content. Because browser extensions often have elevated privileges within the browser context, they provide a stealthy and resilient mechanism for persistence that can bypass traditional endpoint defenses.

Common Methods & Variations

Installation of malicious or trojanized extensions via social engineering or exploitation
Modification of legitimate extensions to include malicious code
Use of browser-specific extension frameworks (e.g., Chrome, Firefox, Edge) across on-premises and cloud environments
Living-off-the-land approaches leveraging existing extension APIs and permissions rather than deploying custom binaries

Indicators of Compromise (IOCs)

Unexpected or unauthorized browser extensions installed on endpoints
Unusual network connections initiated by browser processes
Browser logs showing extension activity outside normal usage patterns
Changes in browser extension manifest files or permissions

Detection Strategies

Monitoring browser extension installation and update events through endpoint telemetry
Behavioral analysis of browser processes for anomalous activity linked to extensions
Correlation of network traffic from browsers with known malicious command and control infrastructure

Mitigation & Prevention

Enforce strict browser extension policies and whitelisting in enterprise environments
Regularly audit installed extensions and their permissions
Implement least privilege principles for browser extension capabilities
Educate users on risks associated with installing untrusted extensions

Response Considerations

Immediately disable or remove suspicious browser extensions
Conduct forensic analysis on affected endpoints to identify scope and persistence mechanisms
Review and reset browser configurations and credentials if compromised
Apply patches and update browser software to mitigate exploitation vectors

Related Techniques

Initial Access via Phishing or Drive-by Compromise
Execution through Browser Script Injection
Defense Evasion by Tampering with Security Tools or Settings
Command and Control via Web Protocols

Mapping & References

MITRE ATT&CK: Persistence – T1547.003 (Boot or Logon Autostart Execution: Browser Extensions)
Public advisories on malicious browser extensions and supply chain risks
Incident reports highlighting browser extension abuse in targeted attacks

Tags: Adversary Techniques Attack Lifecycle Browser Extensions cyber threats Defense Evasion Detection endpoint security Mitigation persistence