Installed Software

The organization permits the installation or execution of unapproved browser extensions, introducing a mechanism by which web-accessible systems, authentication workflows, or data transactions can be intercepted, altered, or exploited. These extensions often operate with elevated browser-level permissions, including access to cookies, session tokens, clipboard content, keystrokes, or internal URLs. In environments where business systems are browser-based and authenticated via SSO or tokenized workflows, this exposure enables passive surveillance or active manipulation of sensitive operations.

Unapproved extensions typically fall outside the control perimeter of traditional endpoint detection tools or access control frameworks. When extension installation is user-controlled or unmonitored, it creates a circumstance in which subjects - intentionally or otherwise - can introduce new capabilities for access, data exfiltration, or surveillance. This includes extensions sourced from public repositories, sideloaded packages, or internally developed tools lacking code review or deployment controls.

The presence of ungoverned extension capability constitutes a durable and distributed access mechanism, especially in cloud-forward or hybrid environments where browser access is the primary interface to organizational systems. In many cases, infringement is made possible not by elevated privilege in the operating system, but by the absence of control within the browser execution layer.

A subject can install unapproved browser with features that frustrate or prevent preventions or detections. Such as built-in VPN, Tor access or automatic browser artifact destruction.

A subject can install an unapproved cloud storage application.

A subject can access or install an File Transfer Protocol (FTP) client which can be used to access FTP servers across the Internet.

A subject can install an unapproved messenger application with the ability to transmit data and/or files across the Internet.

A subject can install an unapproved note taking application (Such as Evernote and Obsidian) with the ability to sync notes across the Internet.

A subject can access or install an Remote Desktop Protocol (RDP) client which can be used to access RDP servers across the Internet.

A subject has access to or can install screen sharing software which can be used to capture images or other information from a target system.

A subject can access or install an Secure Shell (SSH) client which can be used to access SSH servers across the Internet.

A subject has access to a virtual environment on a device.

A subject has access to a VPN application.