Potentially Suspicious Electron Application CommandLine

calendar Sep 6, 2023 · attack.execution  ·
Share on: linkedin copy

Detects potentially suspicious CommandLine of electron apps (teams, discord, slack, etc.). This could be a sign of abuse to proxy execution through a signed binary.

Sigma rule (View on GitHub)

 1title: Potentially Suspicious Electron Application CommandLine
 2id: 378a05d8-963c-46c9-bcce-13c7657eac99
 3related:
 4    - id: f26eb764-fd89-464b-85e2-dc4a8e6e77b8
 5      type: similar
 6status: experimental
 7description: Detects potentially suspicious CommandLine of electron apps (teams, discord, slack, etc.). This could be a sign of abuse to proxy execution through a signed binary.
 8references:
 9    - https://positive.security/blog/ms-officecmd-rce
10    - https://lolbas-project.github.io/lolbas/Binaries/Teams/
11    - https://lolbas-project.github.io/lolbas/Binaries/Msedge/
12    - https://lolbas-project.github.io/lolbas/Binaries/msedgewebview2/
13    - https://medium.com/@MalFuzzer/one-electron-to-rule-them-all-dc2e9b263daf
14    - https://chromium.googlesource.com/chromium/chromium/+/master/content/public/common/content_switches.cc
15author: frack113, Nasreddine Bencherchali (Nextron Systems)
16date: 2023/09/05
17tags:
18    - attack.execution
19logsource:
20    category: process_creation
21    product: windows
22detection:
23    selection:
24        Image|endswith:
25            # Add more electron based app to the list
26            - '\chrome.exe'
27            - '\code.exe'
28            - '\discord.exe'
29            - '\GitHubDesktop.exe'
30            - '\keybase.exe'
31            - '\msedge.exe'
32            - '\msedgewebview2.exe'
33            - '\msteams.exe'
34            - '\slack.exe'
35            - '\Teams.exe'
36        CommandLine|contains:
37            - '--browser-subprocess-path'
38            - '--gpu-launcher'
39            - '--renderer-cmd-prefix'
40            - '--utility-cmd-prefix'
41    condition: selection
42falsepositives:
43    - Legitimate usage for debugging purposes
44# Increase the level once FP rate is known better (see status)
45level: medium

References

  • Windows 10 RCE: The exploit is in the link | Positive Security

    Chaining a misconfiguration in IE11/Edge Legacy with an argument injection in a Windows 10/11 default URI handler and a bypass for a previous Electron patch, we developed a drive-by RCE exploit for Windows 10. The main vulnerability in the ms-officecmd URI handler has not been patched yet and can also be triggered through other browsers (requires confirmation of an inconspicuous dialog) and desktop applications that allow URI opening.


    Read More

  • Teams | LOLBAS

    .. /Teams.exe Microsoft Teams Paths: c:\Users\username\AppData\Local\Microsoft\Teams\current\Teams.exe Acknowledgements: Execute Teams spawns cmd.exe as a child process of teams.exe and executes th...


    Read More

  • Msedge | LOLBAS

    .. /Msedge.exe Star Download Execute Microsoft Edge browser Paths: c:\Program Files\Microsoft\Edge\Application\msedge.exe c:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Resources: htt...


    Read More

  • Msedgewebview2 | LOLBAS

    .. /msedgewebview2.exe msedgewebview2.exe is the executable file for Microsoft Edge WebView2, which is a web browser control used by applications to display web content. Paths: C:\Program Files (x8...


    Read More

  • One Electron to Rule Them All

    Uriel Kosayev — @MalFuzzer


    Read More

  • content/public/common/content_switches.cc - chromium/chromium - Git at Google

    // Copyright (c) 2012 The Chromium Authors. All rights reserved.// Use of this source code is governed by a BSD-style license that can be// found in the LICENSE file.#include "content/public/common...


    Read More

Related rules

to-top