Techniques › T1218.015 › AN0071
AN0071 Analytic 0071
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Abuse of trusted Electron apps (Teams, Slack, Chrome) to spawn child processes or execute payloads via malicious command-line arguments (e.g., --gpu-launcher) and modified app resources (.asar). Behavior chain: suspicious parent process (Electron app) → unusual command-line args → child process creation → optional DLL/network artifacts.</p>
- Detects
- T1218.015 Electron Applications
- Part of
- DET0025 Detecting Electron Application Abuse for Proxy Execution
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
| WinEventLog:Sysmon | EventCode=7 | DC0016 Module Load |
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Correlation window tying app launch, file tampering, child process, and network events (5–10 minutes typical). |
UserContext | Flag admin/service accounts versus standard users executing Electron apps. |
AllowedElectronApps | Baseline of Electron-based executables expected in the enterprise. |
AllowedChildProcesses | Whitelist normal child processes (chrome.exe → crashpad_handler.exe) versus anomalies (powershell.exe). |
ElectronAppDomainAllowlist | Approved service domains for Teams, Slack, etc. to suppress benign traffic. |
AsarIntegrityHash | Expected hash/signature of app.asar resources to detect tampering. |