Potentially Suspicious Electron Application CommandLine

Severity: medium
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Source: upstream

Detects potentially suspicious CommandLine of electron apps (teams, discord, slack, etc.). This could be a sign of abuse to proxy execution through a signed binary.

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation

Stages and Predicates

Stage 1: `all of selection_img`

or:
Image|endswith: '\GitHubDesktop.exe'
Image|endswith: '\Teams.exe'
Image|endswith: '\chrome.exe'
Image|endswith: '\code.exe'
Image|endswith: '\discord.exe'
Image|endswith: '\keybase.exe'
Image|endswith: '\msedge.exe'
Image|endswith: '\msedge_proxy.exe'
Image|endswith: '\msedgewebview2.exe'
Image|endswith: '\msteams.exe'
Image|endswith: '\slack.exe'
OriginalFileName: GitHubDesktop.exe
OriginalFileName: Teams.exe
OriginalFileName: chrome.exe
OriginalFileName: code.exe
OriginalFileName: discord.exe
OriginalFileName: keybase.exe
OriginalFileName: msedge.exe
OriginalFileName: msedge_proxy.exe
OriginalFileName: msedgewebview2.exe
OriginalFileName: msteams.exe
OriginalFileName: slack.exe

Stage 2: `all of selection_cli`

or:
CommandLine|contains: --browser-subprocess-path
CommandLine|contains: --gpu-launcher
CommandLine|contains: --renderer-cmd-prefix
CommandLine|contains: --utility-cmd-prefix

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`--browser-subprocess-path` `--gpu-launcher` `--renderer-cmd-prefix` `--utility-cmd-prefix`
`Image`	ends_with	`\GitHubDesktop.exe` `\Teams.exe` corpus 4 (sigma 4) `\chrome.exe` corpus 11 (sigma 11) `\code.exe` corpus 3 (sigma 3) `\discord.exe` `\keybase.exe` `\msedge.exe` corpus 22 (sigma 22) `\msedge_proxy.exe` corpus 2 (sigma 2) `\msedgewebview2.exe` corpus 15 (sigma 15) `\msteams.exe` corpus 3 (sigma 3) `\slack.exe`
`OriginalFileName`	eq	`GitHubDesktop.exe` `Teams.exe` `chrome.exe` `code.exe` `discord.exe` `keybase.exe` `msedge.exe` `msedge_proxy.exe` corpus 2 (sigma 2) `msedgewebview2.exe` `msteams.exe` corpus 2 (sigma 2) `slack.exe`