Browser Extension Exfiltration Lab

[vvadwlas]

Companion lab to the MCP Prompt Injection Kill Chain, focused on malicious browser extensions attempting credential exfiltration.

What the lab covers

Five distinct attack patterns, all inert, walking through how a malicious browser extension attempts credential theft under different technique variations. Each pattern includes XSIAM correlation walkthrough illustrating detection surfaces available in AES.

Detection surfaces demonstrated

• Browser extension inventory and permission analysis
• Runtime behavior monitoring for credential access patterns
• Outbound data flow correlation
• XSIAM case correlation across the five variations

Cortex AES: Browser Extension Exfiltration - Detection Demonstration Lab

How partners use it

Deploy the lab on your own Cortex tenant to explore AES detection capabilities before customer engagements. Useful for partner engineering team training and for surfacing browser extension risk in customer conversations.

Prerequisites

Own Cortex tenant with AES enabled. Setup guide included in the package.

Access

#links See Attachments

InfoSec cleared for partner distribution.

Feedback

Comments and feedback welcome below. 
Note
For the most current version of this resource, contact the author directly via LIVEcommunity direct message.

Comments and feedback welcome below.

#Cortex AES #Browser Security Credential Exfiltration Lab #Partner Enablement