CIS-9.4 Restrict Unnecessary or Unauthorized Browser and Email Client Extensions

• T1137 Office Application Startup — Restricting email-client add-ins mitigates the add-in portion of this parent technique. • T1137.006 Add-ins — Disabling unauthorized Outlook add-ins prevents those add-ins from automatically loading code when the email client starts. This directly reduces persistence through email-client add-on functionality. • T1176 Software Extensions — This technique includes browser extensions, which are directly addressed by the safeguard. • T1176.001 Browser Extensions — Browser extension allowlists, denylists, installation restrictions, and removal of unauthorized extensions directly prevent malicious browser extensions from establishing persistence or abusing inherited browser permissions. • T1189 Drive-by Compromise — Removing unnecessary or vulnerable browser plug-ins reduces components that a malicious website can enumerate and exploit during a drive-by attack. • T1203 Exploitation for Client Execution — Uninstalling unnecessary browser or email-client plug-ins removes potential client-side exploitation targets. • T1539 Steal Web Session Cookie — Malicious browser extensions may access browser cookies and session information. Restricting extensions removes one important cookie-theft path. • T1555.003 Credentials from Web Browsers — Malicious extensions may access credentials stored in browsers. Extension restrictions reduce that attack surface, but malware already executing with access to the browser profile may still extract stored credentials.