Windows: Suspicious Child Processes Spawned by Electron Apps
Flags suspicious command/scripting child processes launched by Electron apps such as Teams, Discord, Slack, and Edge.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-10-21
- Updated
- 2026-07-30
What it detects
This rule identifies Windows process creation where a known Electron-based application process launches a suspicious child executable or script-related utility. Such behavior can indicate attempts to proxy execution using command-line tooling or to leverage Electron app execution context for follow-on payload activity. It relies on process creation telemetry including ParentImage, Image, and CommandLine fields to match image path patterns and specific command-line substrings.
Reporting behind it
- taggart-tech.comhttps://taggart-tech.com/quasar-electron/
- github.comhttps://github.com/mttaggart/quasar
- positive.securityhttps://positive.security/blog/ms-officecmd-rce
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/Msedge/
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/Teams/
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/msedgewebview2/
- medium.comhttps://medium.com/@MalFuzzer/one-electron-to-rule-them-all-dc2e9b263daf
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_electron_app_children.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-suspicious-child-processes-spawned-by-electron-apps-f26eb764
title: "Windows: Suspicious Child Processes Spawned by Electron Apps"
id: 3243d7a9-5207-4bf1-991d-a2f6fdbaa3f6
related:
- id: 378a05d8-963c-46c9-bcce-13c7657eac99
type: similar
- id: f26eb764-fd89-464b-85e2-dc4a8e6e77b8
type: derived
status: test
description: This rule identifies Windows process creation where a known Electron-based application process launches a suspicious child executable or script-related utility. Such behavior can indicate attempts to proxy execution using command-line tooling or to leverage Electron app execution context for follow-on payload activity. It relies on process creation telemetry including ParentImage, Image, and CommandLine fields to match image path patterns and specific command-line substrings.
references:
- https://taggart-tech.com/quasar-electron/
- https://github.com/mttaggart/quasar
- https://positive.security/blog/ms-officecmd-rce
- https://lolbas-project.github.io/lolbas/Binaries/Msedge/
- https://lolbas-project.github.io/lolbas/Binaries/Teams/
- https://lolbas-project.github.io/lolbas/Binaries/msedgewebview2/
- https://medium.com/@MalFuzzer/one-electron-to-rule-them-all-dc2e9b263daf
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_electron_app_children.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-21
modified: 2024-07-12
tags:
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \chrome.exe
- \discord.exe
- \GitHubDesktop.exe
- \keybase.exe
- \msedge.exe
- \msedgewebview2.exe
- \msteams.exe
- \slack.exe
- \teams.exe
selection_child_image:
Image|endswith:
- \cmd.exe
- \cscript.exe
- \mshta.exe
- \powershell.exe
- \pwsh.exe
- \regsvr32.exe
- \whoami.exe
- \wscript.exe
selection_child_paths:
Image|contains:
- :\ProgramData\
- :\Temp\
- \AppData\Local\Temp\
- \Users\Public\
- \Windows\Temp\
filter_optional_discord:
ParentImage|endswith: \Discord.exe
Image|endswith: \cmd.exe
CommandLine|contains: \NVSMI\nvidia-smi.exe
condition: selection_parent and 1 of selection_child_* and not 1 of filter_optional_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1