BIOC
Medium
✕
Manipulation of Firefox plugins and extensions via the Registry
Plugins and extensions are loaded from all of these Registry keys.
- Module:
- Platform Analytics
- Agent event type:
- Registry
- Category:
- Persistence
- Status:
- Enabled
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Software Extensions: Browser Extensions (T1176.001)
Indicator:
Registry action type = set_registry_value AND registry key name = *SOFTWARE\Mozilla\Firefox\Extensions , *SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions , *software\wow6432node\mozillaplugins\ , *software\mozillaplugins\ Process initiated by != appvclient.exe AND initiator signer != mozilla corporation Host host os = windows
Preventable: yes