URL: https://blueteamlabs.online/home/investigation/81

Browser extensions are a persistent mechanism to access victim’s system. The company decided to check all of the browser extensions in use in the employees’ devices to make sure they are not using any malicious browser extension. We have kept some of the suspicious extension in the Desktop. Please analyze them and report to us.

Reading Material:
Link1
Link2

Scenario Description

Conclusion

Pretty easy lab, learned a little bit more about GPO/Registry keys for blacklisting extensions and also using Powershell to investigate possibly malicious extensions.