Electron Application Files in Unusual AppData Path

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•2•1•11

This rule detects the creation of Electron application runtime files (electron.exe, app.asar, index.js, package.json) by installers like UtilifySetup or Inno Setup in unusual or suspicious AppData\Local subdirectories. This behavior is associated with the Ghost ClickFix attack chain, where compromised systems are used to deploy malicious Electron applications. The rule specifically looks for file creations in paths matching `\appdata\local\(super|max|util)[^\\]*` and installer executables named `utilifysetup.exe`, `setup.exe`, or `is-[a-z0-9]+\.exe`.