Suspicious CommandLine Parameters for Electron Apps on Windows
Alerts on Electron app execution with command-line flags consistent with subprocess and renderer/utility launching behavior.
- Product
- windows
- Category
- process_creation
- Author
- frack113, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-09-05
- Updated
- 2026-07-30
What it detects
This rule flags Windows process creation events where the executed binary matches known Electron-based applications and the command line contains specific Electron launch/runtime parameters (for example, browser subprocess path and renderer/utility command prefixes). Such parameters can indicate an attacker is abusing Electron’s process model to proxy or launch additional components through a legitimate, signed application. It relies on process creation telemetry, matching executable image name or OriginalFileName plus substring matches in the CommandLine.
Reporting behind it
- positive.securityhttps://positive.security/blog/ms-officecmd-rce
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/Teams/
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/Msedge/
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/msedgewebview2/
- medium.comhttps://medium.com/@MalFuzzer/one-electron-to-rule-them-all-dc2e9b263daf
- chromium.googlesource.comhttps://chromium.googlesource.com/chromium/chromium/+/master/content/public/common/content_switches.cc
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_electron_execution_proxy.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Suspicious CommandLine Parameters for Electron Apps on Windows
id: 2d778342-376d-42cf-8250-279b528d04d2
related:
- id: f26eb764-fd89-464b-85e2-dc4a8e6e77b8
type: similar
- id: 378a05d8-963c-46c9-bcce-13c7657eac99
type: derived
status: test
description: This rule flags Windows process creation events where the executed binary matches known Electron-based applications and the command line contains specific Electron launch/runtime parameters (for example, browser subprocess path and renderer/utility command prefixes). Such parameters can indicate an attacker is abusing Electron’s process model to proxy or launch additional components through a legitimate, signed application. It relies on process creation telemetry, matching executable image name or OriginalFileName plus substring matches in the CommandLine.
references:
- https://positive.security/blog/ms-officecmd-rce
- https://lolbas-project.github.io/lolbas/Binaries/Teams/
- https://lolbas-project.github.io/lolbas/Binaries/Msedge/
- https://lolbas-project.github.io/lolbas/Binaries/msedgewebview2/
- https://medium.com/@MalFuzzer/one-electron-to-rule-them-all-dc2e9b263daf
- https://chromium.googlesource.com/chromium/chromium/+/master/content/public/common/content_switches.cc
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_electron_execution_proxy.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-09-05
modified: 2023-11-09
tags:
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith:
- \chrome.exe
- \code.exe
- \discord.exe
- \GitHubDesktop.exe
- \keybase.exe
- \msedge_proxy.exe
- \msedge.exe
- \msedgewebview2.exe
- \msteams.exe
- \slack.exe
- \Teams.exe
- OriginalFileName:
- chrome.exe
- code.exe
- discord.exe
- GitHubDesktop.exe
- keybase.exe
- msedge_proxy.exe
- msedge.exe
- msedgewebview2.exe
- msteams.exe
- slack.exe
- Teams.exe
selection_cli:
CommandLine|contains:
- --browser-subprocess-path
- --gpu-launcher
- --renderer-cmd-prefix
- --utility-cmd-prefix
condition: all of selection_*
falsepositives:
- Legitimate usage for debugging purposes
level: medium
license: DRL-1.1