Suspicious CommandLine Parameters for Electron Apps on Windows

Alerts on Electron app execution with command-line flags consistent with subprocess and renderer/utility launching behavior.

FreeUnreviewedSigmamediumv1

suspicious-commandline-parameters-for-electron-apps-on-windows-378a05d8

title: Suspicious CommandLine Parameters for Electron Apps on Windows
id: 2d778342-376d-42cf-8250-279b528d04d2
related:
  - id: f26eb764-fd89-464b-85e2-dc4a8e6e77b8
    type: similar
  - id: 378a05d8-963c-46c9-bcce-13c7657eac99
    type: derived
status: test
description: This rule flags Windows process creation events where the executed binary matches known Electron-based applications and the command line contains specific Electron launch/runtime parameters (for example, browser subprocess path and renderer/utility command prefixes). Such parameters can indicate an attacker is abusing Electron’s process model to proxy or launch additional components through a legitimate, signed application. It relies on process creation telemetry, matching executable image name or OriginalFileName plus substring matches in the CommandLine.
references:
  - https://positive.security/blog/ms-officecmd-rce
  - https://lolbas-project.github.io/lolbas/Binaries/Teams/
  - https://lolbas-project.github.io/lolbas/Binaries/Msedge/
  - https://lolbas-project.github.io/lolbas/Binaries/msedgewebview2/
  - https://medium.com/@MalFuzzer/one-electron-to-rule-them-all-dc2e9b263daf
  - https://chromium.googlesource.com/chromium/chromium/+/master/content/public/common/content_switches.cc
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_electron_execution_proxy.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-09-05
modified: 2023-11-09
tags:
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \chrome.exe
        - \code.exe
        - \discord.exe
        - \GitHubDesktop.exe
        - \keybase.exe
        - \msedge_proxy.exe
        - \msedge.exe
        - \msedgewebview2.exe
        - \msteams.exe
        - \slack.exe
        - \Teams.exe
    - OriginalFileName:
        - chrome.exe
        - code.exe
        - discord.exe
        - GitHubDesktop.exe
        - keybase.exe
        - msedge_proxy.exe
        - msedge.exe
        - msedgewebview2.exe
        - msteams.exe
        - slack.exe
        - Teams.exe
  selection_cli:
    CommandLine|contains:
      - --browser-subprocess-path
      - --gpu-launcher
      - --renderer-cmd-prefix
      - --utility-cmd-prefix
  condition: all of selection_*
falsepositives:
  - Legitimate usage for debugging purposes
level: medium
license: DRL-1.1

What it detects

This rule flags Windows process creation events where the executed binary matches known Electron-based applications and the command line contains specific Electron launch/runtime parameters (for example, browser subprocess path and renderer/utility command prefixes). Such parameters can indicate an attacker is abusing Electron’s process model to proxy or launch additional components through a legitimate, signed application. It relies on process creation telemetry, matching executable image name or OriginalFileName plus substring matches in the CommandLine.

Known false positives

Legitimate usage for debugging purposes

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.