Windows: Suspicious Child Processes Spawned by Electron Apps

title: "Windows: Suspicious Child Processes Spawned by Electron Apps"
id: 3243d7a9-5207-4bf1-991d-a2f6fdbaa3f6
related:
  - id: 378a05d8-963c-46c9-bcce-13c7657eac99
    type: similar
  - id: f26eb764-fd89-464b-85e2-dc4a8e6e77b8
    type: derived
status: test
description: This rule identifies Windows process creation where a known Electron-based application process launches a suspicious child executable or script-related utility. Such behavior can indicate attempts to proxy execution using command-line tooling or to leverage Electron app execution context for follow-on payload activity. It relies on process creation telemetry including ParentImage, Image, and CommandLine fields to match image path patterns and specific command-line substrings.
references:
  - https://taggart-tech.com/quasar-electron/
  - https://github.com/mttaggart/quasar
  - https://positive.security/blog/ms-officecmd-rce
  - https://lolbas-project.github.io/lolbas/Binaries/Msedge/
  - https://lolbas-project.github.io/lolbas/Binaries/Teams/
  - https://lolbas-project.github.io/lolbas/Binaries/msedgewebview2/
  - https://medium.com/@MalFuzzer/one-electron-to-rule-them-all-dc2e9b263daf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_electron_app_children.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-21
modified: 2024-07-12
tags:
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - \chrome.exe
      - \discord.exe
      - \GitHubDesktop.exe
      - \keybase.exe
      - \msedge.exe
      - \msedgewebview2.exe
      - \msteams.exe
      - \slack.exe
      - \teams.exe
  selection_child_image:
    Image|endswith:
      - \cmd.exe
      - \cscript.exe
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \regsvr32.exe
      - \whoami.exe
      - \wscript.exe
  selection_child_paths:
    Image|contains:
      - :\ProgramData\
      - :\Temp\
      - \AppData\Local\Temp\
      - \Users\Public\
      - \Windows\Temp\
  filter_optional_discord:
    ParentImage|endswith: \Discord.exe
    Image|endswith: \cmd.exe
    CommandLine|contains: \NVSMI\nvidia-smi.exe
  condition: selection_parent and 1 of selection_child_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1