CAPEC-698: Install Malicious Extension
Description
An adversary directly installs or tricks a user into installing a malicious extension into existing trusted software, with the goal of achieving a variety of negative technical impacts.
- Likelihood of attack
- Medium
- Typical severity
- High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Inject Unexpected Items
Prerequisites
- The adversary must craft malware based on the type of software and system(s) they intend to exploit.
- If the adversary intends to install the malicious extension themself, they must first compromise the target machine via some other means.
Skills required
- MediumAbility to create malicious extensions that can exploit specific software applications and systems.
- MediumOptional: Ability to exploit target system(s) via other means in order to gain entry.
Consequences
- ConfidentialityAccess Control
Read Data
- IntegrityAccess Control
Modify Data
- AuthorizationAccess Control
Execute Unauthorized Commands; Alter Execution Logic; Gain Privileges
Mitigations
- Only install extensions/plugins from official/verifiable sources.
- Confirm extensions/plugins are legitimate and not malware masquerading as a legitimate extension/plugin.
- Ensure the underlying software leveraging the extension/plugin (including operating systems) is up-to-date.
- Implement an extension/plugin allow list, based on the given security policy.
- If applicable, confirm extensions/plugins are properly signed by the official developers.
- For web browsers, close sessions when finished to prevent malicious extensions/plugins from executing the the background.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 2 ATT&CK techniques above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-AVEAsset Vulnerability Enumeration2 shared
- D3-RSRestore Software2 shared
- D3-SWISoftware Inventory2 shared
- D3-SUSoftware Update2 shared
- D3-CSCredential Scrubbing1 shared
- D3-DLVDomain Logic Validation1 shared
- D3-TLTrusted Library1 shared
- D3-VIVariable Initialization1 shared
- D3-RNARestore Network Access1 shared
- D3-EREmail Removal1 shared
- D3-EHBEndpoint Health Beacon1 shared
- D3-LLMLogical Link Mapping1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.