T1176Software Extensions
T1176 — Software Extensions is a MITRE ATT&CK technique in the Persistence tactic. Clankerusecase tracks 7 detection use cases covering it and 34 threat-intel articles citing it.
Persistence
7Use cases
34Articles
2Sub-techniques
1Tactic
Sub-techniques (2)
Use cases covering this technique (7)
Suspicious browser extension installation [LLM] Non-Chrome process modifies macOS Chrome Preferences (FlutterShell browser hijack) [LLM] Cyberhaven trojanized Chrome extension C2 callback to cyberhavenext.pro [LLM] VS Code child process fetching payload from nrwl/nx orphan commit (Nx Console v18.95.0 dropper) [LLM] Context.ai compromised Chrome extension installed on host (ID omddlmnhcofjbnbflmjginpjjblphbgk) [LLM] Solidity Language malicious Cursor/VS Code extension folder created on disk (solidityai.solidity-* and related) [LLM] Browser extension folder write at vulnerable React DevTools 4.27.8 / Vue.js devtools 6.5.0Articles citing this technique (34)
high GitHub breached via a malicious VS Code extension: why developer devices are the real target art-238
crit Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack art-315
crit Security metamorphosis: a Mythos-ready architecture checklist for autonomous AI attacks art-331