Electron-CVE-2018-1000006
The query checks process command lines arguments and parent/child combinations to find machines where there have been. Attempts to exploit the Protocol Handler Vulnerability of Electron framework CVE-2018-1000006. Electron is a common framework used by many popular applications (e.g. Skype, Teams, Slack, VSCode) which expose protocol handlers. Which can trigger a remote code execution vulnerability via a browser vector (e.g. Chrome, Internet Explorer, Edge). CVE: CVE-2018-1000006. Read more here:. Https://electronjs.org/blog/protocol-handler-fix. Https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000006. Https://www.exploit-db.com/exploits/43899. Https://hackernoon.com/exploiting-electron-rce-in-exodus-wallet-d9e6db13c374. Tags: #exploit #CVE-2018-1000006 #Electron.
Microsoft Sentinel (KQL)
