BackgroundFix - Dropping Malicious Browser Extensions (T1176)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•3•0•10

Correlates the BackgroundFix script execution with the unauthorized dropping and unpacking of malicious browser extensions into Chrome/Edge local app data paths. Specifically, it detects file creation events in browser extension directories when initiated by 'wscript.exe'.