T1218.015 — Electron Applications

Tactic: Stealth · Platforms: Linux, macOS, Windows

Adversaries may abuse components of the Electron framework to execute malicious code. The Electron framework hosts many common applications such as Signal, Slack, and Microsoft Teams. Originally developed by GitHub, Electron is a cross-platform desktop application development framework that…

Sub-technique of System Binary Proxy Execution (T1218).

Sigma detection rules (3)

T1218.015 System Binary Proxy Execution: Electron Applications

title: "T1218.015 System Binary Proxy Execution: Electron Applications"
id: f4d9282e-d62d-4a19-b341-b766b93fb813
description: 'Detects abuse of Electron-based applications (Teams, Slack, Signal, Discord, VS Code, Atom) for proxy execution, either via debugging/Node-integration flags passed on the command line or via a shell/LOLBin process spawned as a child of an Electron host process. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, UserContext, AllowedElectronApps, AllowedChildProcesses, ElectronAppDomainAllowlist.'
references:
  - https://attack.mitre.org/techniques/T1218/015
author: Shahrukh Khan
date: 2026-03-31
license: MIT
tags:
  - attack.stealth
  - attack.t1218.015

logsource:
  category: process_creation
  product: windows

detection:
  selection_electron_apps:
    ParentImage|endswith:
      - '\Teams.exe'
      - '\Slack.exe'
      - '\Signal.exe'
      - '\Discord.exe'
      - '\Code.exe'
      - '\atom.exe'
  selection_suspicious_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\rundll32.exe'
  selection_electron_flags:
    CommandLine|contains:
      - '--js-flags'
      - '--inspect'
      - '--inspect-brk'
      - '--remote-debugging-port'
      - '--enable-node-integration'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: ((selection_electron_apps and selection_suspicious_child) or selection_electron_flags) and not filter_system_account

falsepositives:
  - Developers using --inspect/--remote-debugging-port for legitimate Electron app debugging; help-desk tooling that spawns a shell from an Electron-based support app.

level: medium

T1218.015 System Binary Proxy Execution: Electron Applications

title: "T1218.015 System Binary Proxy Execution: Electron Applications"
id: 8b215ccf-22ff-47b3-9c7f-81a4f754c62d
description: 'Detecting Electron Application Abuse for Proxy Execution. (Retargeted from the original process_creation label to file_event — this is the telemetry source that actually captures this technique''s behavior; see logsource below.) Tune using: AsarIntegrityCheck, SuspiciousChildProcesses.'
references:
  - https://attack.mitre.org/techniques/T1218/015
author: Shahrukh Khan
date: 2026-05-11
license: MIT
tags:
  - attack.stealth
  - attack.t1218.015

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    TargetFilename|endswith: '.asar'

  filter_electron_install:
    TargetFilename|contains: '\AppData\Local\Programs\'

  condition: selection and not filter_electron_install

falsepositives:
  - Legitimate Electron-app installation/updates write .asar files routinely; the filter excludes the most common legitimate install path, but tune to your specific Electron-based software inventory.

level: medium

T1218.015 System Binary Proxy Execution: Electron Applications

title: "T1218.015 System Binary Proxy Execution: Electron Applications"
id: 9612e34b-28f9-4b96-a409-cce857a9f383
description: 'Detecting Electron Application Abuse for Proxy Execution. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AllowedAppBundlePaths, SignedToUnsignedTransition.'
references:
  - https://attack.mitre.org/techniques/T1218/015
author: Shahrukh Khan
date: 2026-05-25
license: MIT
tags:
  - attack.stealth
  - attack.t1218.015

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    ParentImage|contains: '.app/Contents/MacOS/'
    Image|endswith: '/Electron'
  selection_child:
    ParentCommandLine|contains:
      - '--js-flags'
      - '--inspect'
      - '--remote-debugging-port'
  condition: selection and selection_child

falsepositives:
  - Legitimate Electron based applications such as Slack, VS Code, and Discord occasionally launch with debug flags during crash diagnostics, so this should be scoped to Electron apps outside the standard Applications directory.

level: medium

Related sub-techniques

Explore