Techniques › T1176 › AN0253
AN0253 Analytic 0253
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Manual or script-based installation of extension-like modules into browser config directories or IDE plugin paths, followed by suspicious network activity</p>
- Detects
- T1176 Software Extensions
- Part of
- DET0092 Detection of Malicious or Unauthorized Software Extensions
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | execve | DC0032 Process Creation |
| fs:fileevents | creat | DC0039 File Creation |
| NSM:Flow | Abnormal browser traffic volume or destination | DC0078 Network Traffic Flow |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
DirectoryPath | Common plugin or extension directories may vary by distro or browser (e.g., ~/.config/google-chrome/Default/Extensions) |
ExecPath | Path to scripting tools used in installation (e.g., bash, curl, unzip) |
TimeWindow | Tunable interval between install and first network beacon |