Which SIEM platforms have a T1176 detection rule?

df00tech provides T1176 (Software Extensions) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Software Extensions (T1176)?

Detecting Software Extensions requires the following data sources: File: File Creation, Windows Registry: Windows Registry Key Modification, Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint.

What severity and confidence is the T1176 detection?

The T1176 detection is rated medium severity with medium confidence.

What are common false positives for T1176?

Common false positives for T1176 include: Enterprise IT software packaging tools (SCCM, Intune) that deploy browser extensions as part of managed device configuration; Developer workstations where engineers legitimately install unpacked or sideloaded extensions using --load-extension for development and testing purposes; Security tools or browser management platforms (e.g., Ivanti, Workspace ONE) that configure forced extension installs via Group Policy or registry for enterprise DLP or SSO extensions.

T1176 IBM QRadar · QRadar

Detect Software Extensions in IBM QRadar

Adversaries may abuse software extensions to establish persistent access to victim systems. Software extensions are modular components that enhance or customize the functionality of software applications, including web browsers, Integrated Development Environments (IDEs), and other platforms. Extensions are typically installed via official marketplaces or manually loaded, and they often inherit the permissions and access levels of the host application. Malicious extensions can be introduced through social engineering, compromised marketplaces, or direct installation by adversaries who have already gained system access. Detection is challenging due to the inherent trust placed in extensions and their ability to blend into normal application workflows.

MITRE ATT&CK

Tactic: Persistence
Technique: T1176 Software Extensions
Canonical reference: https://attack.mitre.org/techniques/T1176/

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  DATEFORMAT(startTime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  "username" AS Username,
  "HostName" AS Hostname,
  "Image" AS ProcessImage,
  "CommandLine" AS CommandLine,
  COALESCE("TargetFilename", "TargetObject", "CommandLine") AS ArtifactPath,
  CASE
    WHEN "EventID" = '11' THEN 'SuspiciousExtensionFileWrite'
    WHEN "EventID" IN ('12','13','14') THEN 'ExtensionRegistryForceInstall'
    WHEN "EventID" = '1' THEN 'ExtensionCLIInstall'
    ELSE 'Unknown'
  END AS DetectionType
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND (
    (
      "EventID" = '11'
      AND (
        "TargetFilename" ILIKE '%AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\%'
        OR "TargetFilename" ILIKE '%AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Extensions\\%'
        OR "TargetFilename" ILIKE '%AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\%\\extensions\\%'
        OR "TargetFilename" ILIKE '%\\.vscode\\extensions\\%'
        OR "TargetFilename" ILIKE '%AppData\\Roaming\\Code\\extensions\\%'
      )
      AND (
        "TargetFilename" ILIKE '%.crx'
        OR "TargetFilename" ILIKE '%.xpi'
        OR "TargetFilename" ILIKE '%.vsix'
        OR "TargetFilename" ILIKE '%.js'
        OR "TargetFilename" ILIKE '%manifest.json'
      )
      AND NOT (
        "Image" ILIKE '%\\chrome.exe'
        OR "Image" ILIKE '%\\msedge.exe'
        OR "Image" ILIKE '%\\firefox.exe'
        OR "Image" ILIKE '%\\Code.exe'
        OR "Image" ILIKE '%\\brave.exe'
        OR "Image" ILIKE '%\\opera.exe'
        OR "Image" ILIKE '%\\MicrosoftEdgeUpdate.exe'
        OR "Image" ILIKE '%\\GoogleUpdate.exe'
      )
    )
    OR
    (
      "EventID" IN ('12','13','14')
      AND (
        "TargetObject" ILIKE '%ExtensionInstallForcelist%'
        OR "TargetObject" ILIKE '%ExtensionInstallAllowlist%'
        OR "TargetObject" ILIKE '%ExtensionInstallBlacklist%'
        OR (
          "TargetObject" ILIKE '%\\Extensions\\%'
          AND (
            "TargetObject" ILIKE '%\\Chrome\\%'
            OR "TargetObject" ILIKE '%\\Edge\\%'
            OR "TargetObject" ILIKE '%\\Chromium\\%'
          )
        )
      )
    )
    OR
    (
      "EventID" = '1'
      AND (
        "CommandLine" ILIKE '%--load-extension%'
        OR "CommandLine" ILIKE '%--packed-extension%'
        OR "CommandLine" ILIKE '%--allow-outdated-plugins%'
        OR "CommandLine" ILIKE '%code --install-extension%'
        OR "CommandLine" ILIKE '%code-insiders --install-extension%'
        OR ("CommandLine" ILIKE '%.vsix%' AND "CommandLine" ILIKE '%install%')
        OR (
          "CommandLine" ILIKE '%.crx%'
          AND ("CommandLine" ILIKE '%chrome%' OR "CommandLine" ILIKE '%edge%' OR "CommandLine" ILIKE '%brave%')
        )
      )
    )
  )
  AND startTime > NOW() - 86400000
ORDER BY startTime DESC

high severity medium confidence

QRadar AQL query detecting T1176 Software Extension abuse from Sysmon event logs. Correlates Sysmon EventID 11 (file create) for suspicious extension file writes to browser/IDE directories, EventIDs 12/13/14 (registry create/set/delete) for forced extension policy manipulation, and EventID 1 (process create) for command-line extension installation. Filters legitimate browser and updater processes to reduce noise.

Data Sources

Microsoft Windows Security Event Log log sourceSysmon log source via Windows Event Forwarding or direct agent

Required Tables

events

False Positives & Tuning

Enterprise MDM or endpoint management tools (Intune, SCCM, Jamf) pushing browser extensions via registry GPO settings will generate ExtensionInstallForcelist matches
DevOps engineers and QA teams running automated browser testing frameworks (Selenium, Playwright) frequently use --load-extension to load test extensions in CI pipelines
Software packaging scripts that extract and stage .crx, .xpi, or .vsix files to local directories as part of offline installation bundles will match the file write branch

Download portable Sigma rule (.yml)

Other platforms for T1176

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Sideload Unpacked Chrome Extension via Command Line
Expected signal: Sysmon Event ID 1 (ProcessCreate): Image=chrome.exe, CommandLine containing '--load-extension' and '%TEMP%\malext'. Sysmon Event ID 11 (FileCreate): TargetFilename targeting the malext directory with manifest.json created by cmd.exe. DeviceProcessEvents in MDE will show the Chrome launch with --load-extension flag. DeviceFileEvents will show manifest.json creation by cmd.exe.
Test 2Force Install Browser Extension via Registry Policy
Expected signal: Sysmon Event ID 13 (RegistryValueSet): TargetObject=HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist\1, Details containing the extension ID. Image=reg.exe. DeviceRegistryEvents in MDE: RegistryKey containing 'ExtensionInstallForcelist', RegistryValueData containing the extension ID and update URL. Security Event ID 4657 (Registry value modified) if object access auditing is enabled.
Test 3Install Malicious VSCode Extension from .vsix Package
Expected signal: Sysmon Event ID 1 (ProcessCreate): Image=code.exe (or Code.exe), CommandLine containing '--install-extension' and '.vsix'. Sysmon Event ID 11 (FileCreate): Multiple file writes to %USERPROFILE%\.vscode\extensions\test.test-ext-0.0.1\ directory. DeviceProcessEvents and DeviceFileEvents in MDE will show VSCode CLI invocation and extension directory population.
Test 4Drop Extension Files Directly into Browser Extension Directory
Expected signal: Sysmon Event ID 11 (FileCreate): TargetFilename targeting Chrome Extensions directory with manifest.json and background.js, Image=cmd.exe (not chrome.exe). DeviceFileEvents in MDE: FolderPath containing 'Chrome\User Data\Default\Extensions', FileName=manifest.json and background.js, InitiatingProcessFileName=cmd.exe.
Test 5Enumerate Installed Extensions for Reconnaissance
Expected signal: Sysmon Event ID 1 (ProcessCreate): Image=powershell.exe, CommandLine referencing Chrome Extensions path and Get-ChildItem/Get-Content operations against manifest.json files. Sysmon Event ID 11 may be absent (read-only operation). DeviceProcessEvents in MDE shows PowerShell reading extension manifests. No file modification events, distinguishing this from installation activity.

Last updated: 2026-04-19 Research depth: deep

References (12)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1176 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Software Extensions in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1176

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Sub-techniques (2)

Related Techniques

Same Tactic: Persistence

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1176

Testing Methodology

Unlock Pro Content

Related Detections

Sub-techniques (2)

Related Techniques

Same Tactic: Persistence

Popular Detections

Get new detections in your inbox