AN0071
Analytic 0071
Windows
Abuse of trusted Electron apps (Teams, Slack, Chrome) to spawn child processes or execute payloads via malicious command-line arguments (e.g., --gpu-launcher) and modified app resources (.asar). Behavior chain: suspicious parent process (Electron app) → unusual command-line args → child process creation → optional DLL/network artifacts.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=7
WinEventLog:Sysmon
EventCode=3, 22
[TimeWindow]
Correlation window tying app launch, file tampering, child process, and network events (5–10 minutes typical).
[UserContext]
Flag admin/service accounts versus standard users executing Electron apps.
[AllowedElectronApps]
Baseline of Electron-based executables expected in the enterprise.
[AllowedChildProcesses]
Whitelist normal child processes (chrome.exe → crashpad_handler.exe) versus anomalies (powershell.exe).
[ElectronAppDomainAllowlist]
Approved service domains for Teams, Slack, etc. to suppress benign traffic.
[AsarIntegrityHash]
Expected hash/signature of app.asar resources to detect tampering.
AN0072
Analytic 0072
Linux
Abuse of Linux Electron binaries by modifying app.asar or config JS files and spawning unexpected child processes (bash, curl, python).
auditd:SYSCALL
execve: Electron-based binary spawning shell or script interpreter
WinEventLog:Sysmon
EventCode=11
[AsarIntegrityCheck]
Baseline of expected asar package signatures per app.
[SuspiciousChildProcesses]
Flag shells/python spawned from Electron parent.
AN0073
Analytic 0073
macOS
Abuse of macOS Electron apps by modifying app.asar bundles and spawning child processes (osascript, curl, sh) from Electron executables.
macos:unifiedlog
Electron app spawning unexpected child process
macos:osquery
CREATE/MODIFY: Modification of app.asar inside .app bundle
[AllowedAppBundlePaths]
Baseline of legitimate Electron app paths under /Applications.
[SignedToUnsignedTransition]
Alert when signed Electron parent spawns unsigned child.