ATT&CK technique
View on MITRE ATT&CK →
T1176
Software Extensions
Persistence
10 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Multiple Credential Access by VS Code or Cursor IDE Descendant | production | 2026-10-26 |
| elastic | Suspicious IDE Extension Installation from VSIX | production | 2026-10-26 |
| elastic | Suspicious Command Execution from Visual Studio Code | production | 2026-10-26 |
| elastic | OpenAI ChatGPT Enterprise Unusual Codex Plugin Installed | production | 2026-10-09 |
| elastic | OpenAI ChatGPT Enterprise Custom Agent Published | production | 2026-10-06 |
| elastic | Anthropic MCP Server Created | production | 2026-09-25 |
| elastic | Uncommon Registry Persistence Change | production | 2026-09-18 |
| elastic | Browser Extension Install | production | 2026-09-18 |
| elastic | Manual Loading of a Suspicious Chromium Extension | production | 2026-09-18 |
| sigma | ChromeLoader Malware Execution | test | 2022-01-10 |