Suspicious Electron Application Child Processes

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•1

Detects suspicious child processes of electron apps (teams, discord, slack, etc.). This could be a potential sign of ".asar" file tampering (See reference section for more information) or binary execution proxy through specific CLI arguments (see related rule)