T1176 — Software Extensions

# T1176 - Software Extensions

## SOC Recommendation
Investigate Software Extensions activity in the context of Persistence: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Software Update | Harden | Apply Software Update to reduce this technique's viability before an incident occurs. |
| Restore Software | Restore | Use Restore Software to recover affected systems or data after containment. |
| Software Inventory | Model | Use Software Inventory to establish a baseline that makes this technique's deviations easier to spot. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Remove or disable the unauthorised browser extension from th | Medium | No | Yes |
| If malicious activity is suspected, isolate the device and p | Medium | No | Yes |
| Block the extension ID, publisher, update URL, or related do | Medium | No | Yes |
| Review and remediate browser extension policies, including f | Low | Yes | No |
| Hunt for the same extension ID, publisher, install path, reg | Low | No | Yes |
| Reset affected user credentials and revoke sessions if the e | Medium | No | Yes |
| Add approved business extensions to the allowlist and tune t | Low | Yes | No |

## KQL
```kql
let detectionWindow = 1h;
let baselineWindow = 14d;
let AllowedExtensionIds = dynamic([
    "ppnbnpeolgkicgegkbkbjmhlideopiji" // Microsoft Single Sign-On, installed by policy.
]);
let ExtensionManifestEvents = materialize(
    DeviceFileEvents
    | where TimeGenerated >= ago(baselineWindow)
    | where ActionType in~ ("FileCreated", "FileRenamed")
    | where FileName =~ "manifest.json"
    | extend NormalizedPath = tolower(FolderPath)
    | where NormalizedPath has "\\extensions\\"
    | where NormalizedPath has_any ("\\google\\chrome\\user data\\", "\\microsoft\\edge\\user data\\")
    | extend Browser = case(
        NormalizedPath has "\\google\\chrome\\user data\\", "Chrome",
        NormalizedPath has "\\microsoft\\edge\\user data\\", "Edge",
        "Unknown"
    )
    | extend ExtensionId = extract(@"\\extensions\\([a-p]{32})\\", 1, NormalizedPath)
    | where isnotempty(ExtensionId)
    | where ExtensionId !in~ (AllowedExtensionIds)
);
let PriorExtensions =
    ExtensionManifestEvents
    | where TimeGenerated < ago(detectionWindow)
    | summarize by DeviceId, Browser, ExtensionId;
let NewlyObservedExtensionManifests =
    ExtensionManifestEvents
    | where TimeGenerated >= ago(detectionWindow)
    | join kind=leftanti PriorExtensions on DeviceId, Browser, ExtensionId
    | project
        TimeGenerated,
        DeviceId,
        DeviceName,
        AccountName = InitiatingProcessAccountName,
        Browser,
        ExtensionId,
        EvidenceType = "ExtensionManifestCreated",
        EvidencePath = FolderPath,
        FileName,
        InitiatingProcessFileName,
        InitiatingProcessCommandLine,
        InitiatingProcessSHA256,
        RegistryKey = "",
        RegistryValueName = "",
        RegistryValueData = "";
let ExtensionPolicyInstalls =
    DeviceRegistryEvents
    | where TimeGenerated >= ago(detectionWindow)
    | where ActionType in~ ("RegistryKeyCreated", "RegistryValueSet")
    | extend RegistryKeyLower = tolower(RegistryKey)
    | where RegistryKeyLower has_any (
        "\\software\\policies\\google\\chrome\\extensioninstallforcelist",
        "\\software\\policies\\google\\chrome\\extensionsettings",
        "\\software\\policies\\microsoft\\edge\\extensioninstallforcelist",
        "\\software\\policies\\microsoft\\edge\\extensionsettings"
    )
    | extend Browser = case(
        RegistryKeyLower has "\\google\\chrome\\", "Chrome",
        RegistryKeyLower has "\\microsoft\\edge\\", "Edge",
        "Unknown"
    )
    | extend ExtensionId = extract(@"([a-p]{32})", 1, tolower(strcat(RegistryKey, " ", RegistryValueName, " ", RegistryValueData)))
    | where isempty(ExtensionId) or ExtensionId !in~ (AllowedExtensionIds)
    | extend AccountName = iff(
        isnotempty(tostring(column_ifexists("InitiatingProcessAccountName", ""))),
        tostring(column_ifexists("InitiatingProcessAccountName", "")),
        tostring(column_ifexists("AccountName", ""))
    )
    | project
        TimeGenerated,
        DeviceId,
        DeviceName,
        AccountName,
        Browser,
        ExtensionId,
        EvidenceType = "BrowserExtensionPolicySet",
        EvidencePath = RegistryKey,
        FileName = "",
        InitiatingProcessFileName,
        InitiatingProcessCommandLine,
        InitiatingProcessSHA256,
        RegistryKey,
        RegistryValueName,
        RegistryValueData;
union isfuzzy=true NewlyObservedExtensionManifests, ExtensionPolicyInstalls
| summarize
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated),
    EvidenceTypes = make_set_if(EvidenceType, isnotempty(EvidenceType), 10),
    EvidencePaths = make_set_if(EvidencePath, isnotempty(EvidencePath), 20),
    FileNames = make_set_if(FileName, isnotempty(FileName), 20),
    InitiatingProcesses = make_set_if(InitiatingProcessFileName, isnotempty(InitiatingProcessFileName), 10),
    InitiatingProcessCommandLines = make_set_if(InitiatingProcessCommandLine, isnotempty(InitiatingProcessCommandLine), 10),
    InitiatingProcessHashes = make_set_if(InitiatingProcessSHA256, isnotempty(InitiatingProcessSHA256), 10),
    RegistryValues = make_set_if(RegistryValueData, isnotempty(RegistryValueData), 10)
    by DeviceId, DeviceName, AccountName, Browser, ExtensionId
| extend ExtensionInstallMethod = case(
    set_has_element(EvidenceTypes, "BrowserExtensionPolicySet") and set_has_element(EvidenceTypes, "ExtensionManifestCreated"), "Policy and local manifest",
    set_has_element(EvidenceTypes, "BrowserExtensionPolicySet"), "Policy-based install or force install",
    "Local profile extension manifest"
)
| project
    TimeGenerated = LastSeen,
    FirstSeen,
    LastSeen,
    DeviceId,
    DeviceName,
    AccountName,
    Browser,
    ExtensionId,
    ExtensionInstallMethod,
    EvidenceTypes,
    EvidencePaths,
    FileNames,
    InitiatingProcesses,
    InitiatingProcessCommandLines,
    InitiatingProcessHashes,
    RegistryValues
| extend timestamp = TimeGenerated,
         HostCustomEntity = DeviceName,
         AccountCustomEntity = AccountName
| order by TimeGenerated desc
```
```kql
let threshold = 5;
GWorkspaceActivityReports
| where isnotempty(UserAgentOriginal)
| summarize user_ua = makeset(UserAgentOriginal) by SrcIpAddr, bin(TimeGenerated, 5m)
| where array_length(user_ua) > threshold
| extend IPCustomEntity = SrcIpAddr
```

## Escalation Criteria
- Software Extensions activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1176.json
• /api/recommendations/T1176.json
• /api/d3fend/T1176.json
• /api/mappings/T1176.json
• /api/confluence/T1176.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1176.json

Response:

{
  "technique_id": "T1176",
  "name": "Software Extensions",
  "priority": "high",
  "status": "complete",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Persistence"
  ],
  "platforms": [
    "Linux",
    "macOS",
    "Windows"
  ],
  "summary": "Adversaries may abuse software extensions to establish persistent access to victim systems. Software extensions are modular components that enhance or customize the functionality of software applications, including web browsers, Integrated Development Environments (IDEs), and other platforms. Extensions are typically installed via official marketplaces, app stores, or manually loaded by users, and they often inherit the permissions and access levels of the host application...",
  "soc_recommendation": "Investigate Software Extensions activity in the context of Persistence: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-SU",
      "name": "Software Update",
      "relationship": "harden",
      "practical_action": "Apply Software Update to reduce this technique's viability before an incident occurs.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-RS",
      "name": "Restore Software",
      "relationship": "restore",
      "practical_action": "Use Restore Software to recover affected systems or data after containment.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-SWI",
      "name": "Software Inventory",
      "relationship": "model",
      "practical_action": "Use Software Inventory to establish a baseline that makes this technique's deviations easier to spot.",
      "tooling": [
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.",
      "Check Sentinel analytics rules and incidents correlated with this technique.",
      "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource."
    ],
    "generic": [
      "Confirm whether the observed software extensions activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"Browser Extension Added to Chrome or Edge\" -- Detects newly observed Chrome or Edge browser extensions on an endpoint, including user-profile extension manifests and policy-based forced installs."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Remove or disable the unauthorised browser extension from th",
      "category": "Response",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Remove or disable the unauthorised browser extension from the affected browser profile or policy configuration"
    },
    {
      "name": "If malicious activity is suspected, isolate the device and p",
      "category": "Response",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "If malicious activity is suspected, isolate the device and preserve the extension files, manifest, registry keys, process details, and network evidence"
    },
    {
      "name": "Block the extension ID, publisher, update URL, or related do",
      "category": "Response",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Block the extension ID, publisher, update URL, or related domains using browser management policy, Defender, proxy, or endpoint controls"
    },
    {
      "name": "Review and remediate browser extension policies, including f",
      "category": "Response",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "See investigation guide",
      "notes": "Review and remediate browser extension policies, including forced-install lists and extension settings for Chrome and Edge"
    },
    {
      "name": "Hunt for the same extension ID, publisher, install path, reg",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Hunt for the same extension ID, publisher, install path, registry value, or initiating process across other endpoints and users"
    },
    {
      "name": "Reset affected user credentials and revoke sessions if the e",
      "category": "Response",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Reset affected user credentials and revoke sessions if the extension had access to cookies, credentials, browsing data, or sensitive web applications"
    },
    {
      "name": "Add approved business extensions to the allowlist and tune t",
      "category": "Response",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "See investigation guide",
      "notes": "Add approved business extensions to the allowlist and tune the rule only after authorisation is confirmed"
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "GEN-CO-002 — Browser Extension Added to Chrome or Edge",
        "description": "Detects newly observed Chrome or Edge browser extensions on an endpoint, including user-profile extension manifests and policy-based forced installs. (Source: Bell Integration baseline detection library, mapped via sub-technique T1176.001.)",
        "query": "let detectionWindow = 1h;\nlet baselineWindow = 14d;\nlet AllowedExtensionIds = dynamic([\n    \"ppnbnpeolgkicgegkbkbjmhlideopiji\" // Microsoft Single Sign-On, installed by policy.\n]);\nlet ExtensionManifestEvents = materialize(\n    DeviceFileEvents\n    | where TimeGenerated >= ago(baselineWindow)\n    | where ActionType in~ (\"FileCreated\", \"FileRenamed\")\n    | where FileName =~ \"manifest.json\"\n    | extend NormalizedPath = tolower(FolderPath)\n    | where NormalizedPath has \"\\\\extensions\\\\\"\n    | where NormalizedPath has_any (\"\\\\google\\\\chrome\\\\user data\\\\\", \"\\\\microsoft\\\\edge\\\\user data\\\\\")\n    | extend Browser = case(\n        NormalizedPath has \"\\\\google\\\\chrome\\\\user data\\\\\", \"Chrome\",\n        NormalizedPath has \"\\\\microsoft\\\\edge\\\\user data\\\\\", \"Edge\",\n        \"Unknown\"\n    )\n    | extend ExtensionId = extract(@\"\\\\extensions\\\\([a-p]{32})\\\\\", 1, NormalizedPath)\n    | where isnotempty(ExtensionId)\n    | where ExtensionId !in~ (AllowedExtensionIds)\n);\nlet PriorExtensions =\n    ExtensionManifestEvents\n    | where TimeGenerated < ago(detectionWindow)\n    | summarize by DeviceId, Browser, ExtensionId;\nlet NewlyObservedExtensionManifests =\n    ExtensionManifestEvents\n    | where TimeGenerated >= ago(detectionWindow)\n    | join kind=leftanti PriorExtensions on DeviceId, Browser, ExtensionId\n    | project\n        TimeGenerated,\n        DeviceId,\n        DeviceName,\n        AccountName = InitiatingProcessAccountName,\n        Browser,\n        ExtensionId,\n        EvidenceType = \"ExtensionManifestCreated\",\n        EvidencePath = FolderPath,\n        FileName,\n        InitiatingProcessFileName,\n        InitiatingProcessCommandLine,\n        InitiatingProcessSHA256,\n        RegistryKey = \"\",\n        RegistryValueName = \"\",\n        RegistryValueData = \"\";\nlet ExtensionPolicyInstalls =\n    DeviceRegistryEvents\n    | where TimeGenerated >= ago(detectionWindow)\n    | where ActionType in~ (\"RegistryKeyCreated\", \"RegistryValueSet\")\n    | extend RegistryKeyLower = tolower(RegistryKey)\n    | where RegistryKeyLower has_any (\n        \"\\\\software\\\\policies\\\\google\\\\chrome\\\\extensioninstallforcelist\",\n        \"\\\\software\\\\policies\\\\google\\\\chrome\\\\extensionsettings\",\n        \"\\\\software\\\\policies\\\\microsoft\\\\edge\\\\extensioninstallforcelist\",\n        \"\\\\software\\\\policies\\\\microsoft\\\\edge\\\\extensionsettings\"\n    )\n    | extend Browser = case(\n        RegistryKeyLower has \"\\\\google\\\\chrome\\\\\", \"Chrome\",\n        RegistryKeyLower has \"\\\\microsoft\\\\edge\\\\\", \"Edge\",\n        \"Unknown\"\n    )\n    | extend ExtensionId = extract(@\"([a-p]{32})\", 1, tolower(strcat(RegistryKey, \" \", RegistryValueName, \" \", RegistryValueData)))\n    | where isempty(ExtensionId) or ExtensionId !in~ (AllowedExtensionIds)\n    | extend AccountName = iff(\n        isnotempty(tostring(column_ifexists(\"InitiatingProcessAccountName\", \"\"))),\n        tostring(column_ifexists(\"InitiatingProcessAccountName\", \"\")),\n        tostring(column_ifexists(\"AccountName\", \"\"))\n    )\n    | project\n        TimeGenerated,\n        DeviceId,\n        DeviceName,\n        AccountName,\n        Browser,\n        ExtensionId,\n        EvidenceType = \"BrowserExtensionPolicySet\",\n        EvidencePath = RegistryKey,\n        FileName = \"\",\n        InitiatingProcessFileName,\n        InitiatingProcessCommandLine,\n        InitiatingProcessSHA256,\n        RegistryKey,\n        RegistryValueName,\n        RegistryValueData;\nunion isfuzzy=true NewlyObservedExtensionManifests, ExtensionPolicyInstalls\n| summarize\n    FirstSeen = min(TimeGenerated),\n    LastSeen = max(TimeGenerated),\n    EvidenceTypes = make_set_if(EvidenceType, isnotempty(EvidenceType), 10),\n    EvidencePaths = make_set_if(EvidencePath, isnotempty(EvidencePath), 20),\n    FileNames = make_set_if(FileName, isnotempty(FileName), 20),\n    InitiatingProcesses = make_set_if(InitiatingProcessFileName, isnotempty(InitiatingProcessFileName), 10),\n    InitiatingProcessCommandLines = make_set_if(InitiatingProcessCommandLine, isnotempty(InitiatingProcessCommandLine), 10),\n    InitiatingProcessHashes = make_set_if(InitiatingProcessSHA256, isnotempty(InitiatingProcessSHA256), 10),\n    RegistryValues = make_set_if(RegistryValueData, isnotempty(RegistryValueData), 10)\n    by DeviceId, DeviceName, AccountName, Browser, ExtensionId\n| extend ExtensionInstallMethod = case(\n    set_has_element(EvidenceTypes, \"BrowserExtensionPolicySet\") and set_has_element(EvidenceTypes, \"ExtensionManifestCreated\"), \"Policy and local manifest\",\n    set_has_element(EvidenceTypes, \"BrowserExtensionPolicySet\"), \"Policy-based install or force install\",\n    \"Local profile extension manifest\"\n)\n| project\n    TimeGenerated = LastSeen,\n    FirstSeen,\n    LastSeen,\n    DeviceId,\n    DeviceName,\n    AccountName,\n    Browser,\n    ExtensionId,\n    ExtensionInstallMethod,\n    EvidenceTypes,\n    EvidencePaths,\n    FileNames,\n    InitiatingProcesses,\n    InitiatingProcessCommandLines,\n    InitiatingProcessHashes,\n    RegistryValues\n| extend timestamp = TimeGenerated,\n         HostCustomEntity = DeviceName,\n         AccountCustomEntity = AccountName\n| order by TimeGenerated desc"
      },
      {
        "name": "6ff0e16e-5999-11ec-bf63-0242ac130002 — GWorkspace - Multiple user agents for single source",
        "description": "Detects requests with different user agents from one source in short timeframe.' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "let threshold = 5;\nGWorkspaceActivityReports\n| where isnotempty(UserAgentOriginal)\n| summarize user_ua = makeset(UserAgentOriginal) by SrcIpAddr, bin(TimeGenerated, 5m)\n| where array_length(user_ua) > threshold\n| extend IPCustomEntity = SrcIpAddr"
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "f1f3070e-045c-4e03-ae58-d11d43d2ee51 — Manual Loading of a Suspicious Chromium Extension",
        "description": "(EQL) Detects the manual loading of a Chromium-based browser extension via command line arguments. This activity is suspicious and could indicate a threat actor loading a malicious extension to persist or collect browsing secrets such as cookies and authentication tokens. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "process where host.os.type == \"macos\" and event.action == \"exec\" and\n  process.name in (\"Google Chrome\", \"Brave Browser\", \"Microsoft Edge\") and\n  process.args like \"--load-extension=/*\" and\n  not (process.args like \"--load-extension=/Users/*/Library/Application Support/Cypress/*\" and\n       process.parent.executable like (\"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome\",\n                                        \"/Users/*/Library/Caches/Cypress/*/Cypress.app/Contents/MacOS/Cypress\")) and\n  not process.parent.executable like (\"/opt/homebrew/Caskroom/chromedriver/*/chromedriver\",\n                                    \"/Applications/Cypress.app/Contents/MacOS/Cypress\",\n                                    \"/usr/local/bin/chromedriver\")"
      },
      {
        "name": "54902e45-3467-49a4-8abc-529f2c8cfb80 — Uncommon Registry Persistence Change",
        "description": "(EQL) Detects changes to registry persistence keys that are not commonly used or modified by legitimate programs. This could be an indication of an adversary's attempt to persist in a stealthy manner. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "registry where host.os.type == \"windows\" and event.type == \"change\" and\n length(registry.data.strings) > 0 and\n registry.path : (\n      \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Terminal Server\\\\Install\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\*\",\n      \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Terminal Server\\\\Install\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Runonce\\\\*\",\n      \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\Load\",\n      \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\Run\",\n      \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\IconServiceLib\",\n      \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Shell\",\n      \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Shell\",\n      \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\AppSetup\",\n      \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Taskman\",\n      \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Userinit\",\n      \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\VmApplet\",\n      \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\\\*\",\n      \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\Shell\",\n      \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Logoff\\\\Script\",\n      \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Logon\\\\Script\",\n      \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Shutdown\\\\Script\",\n      \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Startup\\\\Script\",\n      \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\\\*\",\n      \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\Shell\",\n      \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Logoff\\\\Script\",\n      \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Logon\\\\Script\",\n      \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Shutdown\\\\Script\",\n      \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Startup\\\\Script\",\n      \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Active Setup\\\\Installed Components\\\\*\\\\ShellComponent\",\n      \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows CE Services\\\\AutoStartOnConnect\\\\MicrosoftActiveSync\",\n      \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows CE Services\\\\AutoStartOnDisconnect\\\\MicrosoftActiveSync\",\n      \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Ctf\\\\LangBarAddin\\\\*\\\\FilePath\",\n      \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Internet Explorer\\\\Extensions\\\\*\\\\Exec\",\n      \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Internet Explorer\\\\Extensions\\\\*\\\\Script\",\n      \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Command Processor\\\\Autorun\",\n      \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Ctf\\\\LangBarAddin\\\\*\\\\FilePath\",\n      \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Internet Explorer\\\\Extensions\\\\*\\\\Exec\",\n      \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Internet Explorer\\\\Extensions\\\\*\\\\Script\",\n      \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Command Processor\\\\Autorun\",\n      \"HKEY_USERS\\\\*\\\\Control Panel\\\\Desktop\\\\scrnsave.exe\",\n      \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Image File Execution Options\\\\*\\\\VerifierDlls\",\n      \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\GpExtensions\\\\*\\\\DllName\",\n      \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\SafeBoot\\\\AlternateShell\",\n      \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\Terminal Server\\\\Wds\\\\rdpwd\\\\StartupPrograms\",\n      \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\Terminal Server\\\\WinStations\\\\RDP-Tcp\\\\InitialProgram\",\n      \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\Session Manager\\\\BootExecute\",\n      \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\Session Manager\\\\BootExecuteNoPnpSync\",\n      \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\Session Manager\\\\SetupExecute\",\n      \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\Session Manager\\\\SetupExecuteNoPnpSync\",\n      \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\Session Manager\\\\PlatformExecute\",\n      \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\Session Manager\\\\Execute\",\n      \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\Session Manager\\\\S0InitialCommand\",\n      \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\ServiceControlManagerExtension\",\n      \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\BootVerificationProgram\\\\ImagePath\",\n      \"HKLM\\\\SYSTEM\\\\Setup\\\\CmdLine\",\n      \"HKEY_USERS\\\\*\\\\Environment\\\\UserInitMprLogonScript\") and\n\n not registry.data.strings : (\"C:\\\\Windows\\\\system32\\\\userinit.exe\", \"cmd.exe\", \"C:\\\\Program Files (x86)\\\\*.exe\",\n                              \"C:\\\\Program Files\\\\*.exe\") and\n not (process.name : \"rundll32.exe\" and registry.path : \"*\\\\Software\\\\Microsoft\\\\Internet Explorer\\\\Extensions\\\\*\\\\Script\") and\n not process.executable : (\"C:\\\\Windows\\\\System32\\\\msiexec.exe\",\n                           \"C:\\\\Windows\\\\SysWOW64\\\\msiexec.exe\",\n                           \"C:\\\\ProgramData\\\\Microsoft\\\\Windows Defender\\\\Platform\\\\*\\\\MsMpEng.exe\",\n                           \"C:\\\\Program Files\\\\*.exe\",\n                           \"C:\\\\Program Files (x86)\\\\*.exe\") and\n not (process.name : (\"TiWorker.exe\", \"poqexec.exe\") and registry.value : \"SetupExecute\" and\n      registry.data.strings : (\n        \"C:\\\\windows\\\\System32\\\\poqexec.exe /display_progress \\\\SystemRoot\\\\WinSxS\\\\pending.xml\",\n        \"C:\\\\Windows\\\\System32\\\\poqexec.exe /skip_critical_poq /display_progress \\\\SystemRoot\\\\WinSxS\\\\pending.xml\"\n      )\n     ) and\n not (process.name : \"svchost.exe\" and registry.value : \"SCRNSAVE.EXE\" and\n      registry.data.strings : (\n        \"%windir%\\\\system32\\\\rundll32.exe user32.dll,LockWorkStation\",\n        \"scrnsave.scr\",\n        \"%windir%\\\\system32\\\\Ribbons.scr\"\n      )\n     )"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Software Extensions activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate administrative or maintenance activity matching this pattern.",
    "Approved security testing or red team exercise.",
    "Known benign software producing similar telemetry."
  ],
  "confluence": {
    "title": "T1176 - Software Extensions Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}