Browser Extension Install
ELASTIC detection rule by Elastic · Elastic License v2
Identifies the install of browser extensions. Malicious browser extensions can be installed via app store downloads
masquerading as legitimate extensions, social engineering, or by an adversary that has already compromised a system.
[metadata]
creation_date = "2023/08/22"
integration = ["endpoint", "m365_defender", "sentinel_one_cloud_funnel", "windows"]
maturity = "production"
updated_date = "2026/05/04"
[rule]
author = ["Elastic"]
description = """
Identifies the install of browser extensions. Malicious browser extensions can be installed via app store downloads
masquerading as legitimate extensions, social engineering, or by an adversary that has already compromised a system.
"""
from = "now-9m"
index = [
"logs-endpoint.events.file-*",
"logs-m365_defender.event-*",
"logs-sentinel_one_cloud_funnel.*",
"logs-windows.sysmon_operational-*",
"winlogbeat-*",
"endgame-*",
]
language = "eql"
license = "Elastic License v2"
name = "Browser Extension Install"
note = """## Triage and analysis
> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
### Investigating Browser Extension Install
Browser extensions enhance functionality in web browsers but can be exploited by adversaries to gain persistence or execute malicious activities. Attackers may disguise harmful extensions as legitimate or use compromised systems to install them. The detection rule identifies suspicious extension installations by monitoring file creation events in typical extension directories, filtering out known safe processes, and focusing on Windows environments.
### Possible investigation steps
- Review the file creation event details to identify the specific browser extension file (e.g., .xpi or .crx) and its path to determine if it aligns with known malicious patterns or locations.
- Check the process that initiated the file creation event, especially if it is not a known safe process like firefox.exe, to assess if it is a legitimate application or potentially malicious.
- Investigate the user account associated with the file creation event to determine if the activity is expected or if the account may have been compromised.
- Examine recent system activity and logs for any signs of social engineering attempts or unauthorized access that could have led to the installation of the extension.
- Cross-reference the extension file name and path with threat intelligence sources to identify if it is associated with known malicious browser extensions.
- If applicable, review the browser's extension management interface to verify the presence and legitimacy of the installed extension.
### False positive analysis
- Language pack installations for Firefox can trigger false positives. Exclude files named "langpack-*@firefox.mozilla.org.xpi" from detection to prevent unnecessary alerts.
- Dictionary add-ons for Firefox may also be flagged. Add exceptions for files named "*@dictionaries.addons.mozilla.org.xpi" to reduce false positives.
- Regular updates or installations of legitimate browser extensions from trusted sources can be mistaken for malicious activity. Maintain a list of trusted processes and paths to exclude from monitoring.
- User-initiated installations from official browser stores might be flagged. Educate users on safe installation practices and consider excluding known safe processes like "firefox.exe" when associated with legitimate extension paths.
- Frequent installations in enterprise environments due to software deployment tools can cause alerts. Coordinate with IT to identify and exclude these routine activities from detection.
### Response and remediation
- Isolate the affected system from the network to prevent further spread or communication with potential command and control servers.
- Terminate any suspicious processes associated with the unauthorized browser extension installation, such as unknown or unexpected instances of browser processes.
- Remove the malicious browser extension by deleting the associated files from the extension directories identified in the alert.
- Conduct a full antivirus and anti-malware scan on the affected system to identify and remove any additional threats or remnants of the malicious extension.
- Review and reset browser settings to default to ensure no residual configurations or settings are left by the malicious extension.
- Escalate the incident to the security operations team for further investigation and to determine if additional systems are affected.
- Implement application whitelisting to prevent unauthorized browser extensions from being installed in the future, focusing on the directories and file types identified in the detection query."""
risk_score = 21
rule_id = "f97504ac-1053-498f-aeaa-c6d01e76b379"
severity = "low"
tags = [
"Domain: Endpoint",
"OS: Windows",
"Use Case: Threat Detection",
"Tactic: Persistence",
"Data Source: Elastic Defend",
"Data Source: Elastic Endgame",
"Data Source: SentinelOne",
"Data Source: Sysmon",
"Data Source: Microsoft Defender XDR",
"Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
file where host.os.type == "windows" and event.type : "creation" and
(
/* Firefox-Based Browsers */
(
file.name : "*.xpi" and
file.path : "?:\\Users\\*\\AppData\\Roaming\\*\\Profiles\\*\\Extensions\\*.xpi" and
not
(
process.name : "firefox.exe" and
file.name : (
"langpack-*@firefox.mozilla.org.xpi",
"*@dictionaries.addons.mozilla.org.xpi",
"newtab@mozilla.org.xpi",
"uBlock0@raymondhill.net.xpi",
/* AdBlockPlus */
"{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi",
/* Bitwarden */
"{446900e4-71c2-419f-a6a7-df9c091e268b}.xpi",
"addon@darkreader.org.xpi",
/* 1Password */
"{d634138d-c276-4fc8-924b-40a0ea21d284}.xpi",
"support@lastpass.com.xpi",
/* Grammarly */
"87677a2c52b84ad3a151a4a72f5bd3c4@jetpack.xpi",
"sentinelone_visibility@sentinelone.com.xpi",
"keepassxc-browser@keepassxc.org.xpi"
)
)
) or
/* Chromium-Based Browsers */
(
file.name : "*.crx" and
file.path : "?:\\Users\\*\\AppData\\Local\\*\\*\\User Data\\Webstore Downloads\\*"
)
)
'''
setup = """## Setup
This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
Setup instructions: https://ela.st/install-elastic-defend
### Additional data sources
This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Event ID 11 - File Create](https://ela.st/sysmon-event-11-setup)
"""
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1176"
name = "Software Extensions"
reference = "https://attack.mitre.org/techniques/T1176/"
[[rule.threat.technique.subtechnique]]
id = "T1176.001"
name = "Browser Extensions"
reference = "https://attack.mitre.org/techniques/T1176/001/"
[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"