Suspicious Command-Line Arguments in Electron Applications
This rule detects potentially suspicious command-line arguments used with Electron-based applications such as Microsoft Teams, Discord, Slack, Microsoft Edge, and VS Code. The presence of specific command-line switches like '--browser-subprocess-path', '--gpu-launcher', '--renderer-cmd-prefix', or '--utility-cmd-prefix' in conjunction with these applications could indicate an attempt to abuse these signed binaries for proxy execution of malicious code, potentially bypassing security controls.
Sigma
