Electron launcher switch used to run an arbitrary child process

Siemphony@siemphonyhighT1218.015unverified

AN0071's command-line leg taken on its own. Electron and the Chromium engine underneath it accept several switches whose value is executed as a program, so the switch is the detection and no inventory of Electron applications is needed — an app that never made it into MITRE's AllowedElectronApps baseline is caught the same way a known one is. The first term is the --gpu-launcher form from ATT&CK's own example on this technique page; the other three are the closely related renderer, utility and subprocess-path variants and are authored here, not drawn from the brief. The rest of AN0071 — .asar tampering, module loads and the callout that follows — spans four further log sources correlated over MITRE's TimeWindow knob, which Sigma cannot express, so this rule stands on the launch argument alone and says nothing about what the child then did. It needs a process-creation source that records the full command line: Sysmon EventID 1 does so natively, Security 4688 only with Audit Process Creation plus the separate Include command line in process creation events policy, and neither is enabled by default. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0025, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (ProcessCommandLine contains "--gpu-launcher=" or ProcessCommandLine contains "--renderer-cmd-prefix=" or ProcessCommandLine contains "--utility-cmd-prefix=" or ProcessCommandLine contains "--browser-subprocess-path=")

Splunk · SPL

Run this as a search.

index=* (CommandLine="*--gpu-launcher=*" OR CommandLine="*--renderer-cmd-prefix=*" OR CommandLine="*--utility-cmd-prefix=*" OR CommandLine="*--browser-subprocess-path=*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.command_line) LIKE "*--gpu-launcher=*" OR TO_LOWER(process.command_line) LIKE "*--renderer-cmd-prefix=*" OR TO_LOWER(process.command_line) LIKE "*--utility-cmd-prefix=*" OR TO_LOWER(process.command_line) LIKE "*--browser-subprocess-path=*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(--gpu-launcher=|--renderer-cmd-prefix=|--utility-cmd-prefix=|--browser-subprocess-path=)</field>    <description>Electron launcher switch used to run an arbitrary child process</description>    <mitre>      <id>T1218.015</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: high
Category: signed_binary_proxy
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: e82828ff-98bb-4fab-ba7b-227b759d1ba3

ATT&CKT1218.015

T1218.015Electron Applications

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonsigned binary proxy

signed binary proxyAI draft — unreviewed

01 · What this rule detects

An Electron or Chromium application launched with a switch whose value Chromium then executes as a program. Electron apps — Teams, Slack, Signal, and a long tail of vendor software — are signed, trusted, and already on the endpoint. The Chromium engine underneath them accepts several switches that name a program to run as a child process. ATT&CK's own example is chrome.exe --disable-gpu-sandbox --gpu-launcher="C:\Windows\system32\cmd.exe /c calc.exe". Making the switch the detection is the rule's best idea: no inventory of Electron applications is needed, so an app that never made it into MITRE's AllowedElectronApps baseline is caught exactly like a known one. MITRE's analytic AN0071 describes a four-source chain — app launch, .asar tampering, child process, network callout — correlated across a TimeWindow knob. Sigma has no sequence operator, so this rule is the launch argument alone and says nothing about what the child then did.

02 · Telemetry you need

Process creation with the full command line. Sysmon EventID 1 carries it
Note the tag: the brief's tactics field says stealth (ATT&CK v19 split

03 · How the logic works

All four are real Chromium switches (kGpuLauncher, kRendererCmdPrefix, kUtilityCmdPrefix, kBrowserSubprocessPath) — no dead selectors. The first is from ATT&CK's own example; the other three are authored here as the closely related renderer, utility and subprocess-path variants. And every one of them is anchored to `--`, which is the finding. Chromium's Windows command-line parser accepts three switch prefixes: --, - and /. So /gpu-launcher=C:\Windows\System32\cmd.exe and -gpu-launcher=cmd.exe execute precisely as the double-dash form does, and match none of the four terms. That is a one-character bypass of the entire rule. This is the concrete case for a modifier the corpus contract explicitly permits and this rule did not use: `windash`. Written in single-dash form with the modifier applied —

— Sigma expands each value across the dash variants a Windows parser accepts and renders all of them into every backend. The rule for a beginner: any time you match a Windows command-line switch literally, ask which prefixes the target program's parser accepts, and reach for `windash` rather than writing the variants out by hand. A rule matching only -- when the parser also takes / is one an attacker walks past without trying. The second limitation is that the rule matches the switch and never looks at its value. ATT&CK's example pairs --gpu-launcher with cmd.exe, and the real discriminator is that the value names an interpreter, or a path outside the application's own install directory. As written, a CEF app pointing --browser-subprocess-path at its own bundled helper is indistinguishable from an attacker pointing it at cmd.exe, and nothing prefers the second.

04 · Common false positives

`--browser-subprocess-path=` is the loud one. Essentially every
Chromium and Electron developers debugging locally. The renderer and utility
UI test harnesses and crash-reporting wrappers launching through a prefix

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0025 and never executed against a single log line.
tier_2: is running it over historical process-creation data to learn how much CEF software you actually run, and adding windash so the coverage claim becomes true.
tier_3: needs AN0071's chain — .asar integrity, child process, callout — joined inside MITRE's TimeWindow, outside Sigma entirely.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Scope away from build and engineering workstations rather than deleting terms.
Know why two terms will be near-silent: --renderer-cmd-prefix and
Add a second selection on the value shape — cmd.exe, powershell.exe,
MITRE's AllowedChildProcesses knob is where chrome.exe → crashpad_handler.exe

Declared by the author

Chromium and Electron developers debugging locally. The renderer and utility cmd-prefix switches are the documented way to attach a debugger or a profiler to a child process, so they are routine on engineering workstations and should be near-absent everywhere else — scope this rule away from build machines rather than tuning the terms.
Packaged applications that embed their own Chromium and legitimately point browser-subprocess-path at a helper binary they ship. This is the noisiest of the four terms and the first to drop if the estate runs such an application.
Automated UI test harnesses and crash-reporting wrappers that launch a browser through a prefix command as a normal part of a QA or release pipeline.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1218.015, evaluated against their process_creation events.

Share this rule

/u/siemphony/e82828ff-98bb-4fab-ba7b-227b759d1ba3

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Electron launcher switch used to run an arbitrary child process

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it