Electron-CVE-2018-1000006

id: 2953f075-035c-4803-9ea2-a9b0771ffc3d
name: Electron-CVE-2018-1000006
description: |
  The query checks process command lines arguments and parent/child combinations to find machines where there have been.
  Attempts to exploit the Protocol Handler Vulnerability of Electron framework CVE-2018-1000006.
  Electron is a common framework used by many popular applications (e.g. Skype, Teams, Slack, VSCode) which expose protocol handlers.
  Which can trigger a remote code execution vulnerability via a browser vector (e.g. Chrome, Internet Explorer, Edge).
  CVE: CVE-2018-1000006.
  Read more here:.
  Https://electronjs.org/blog/protocol-handler-fix.
  Https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000006.
  Https://www.exploit-db.com/exploits/43899.
  Https://hackernoon.com/exploiting-electron-rce-in-exodus-wallet-d9e6db13c374.
  Tags: #exploit #CVE-2018-1000006 #Electron.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
query: |
  DeviceProcessEvents 
  | where Timestamp > ago(14d) 
  | where FileName in~ ("code.exe", "skype.exe", "slack.exe", "teams.exe") 
  | where InitiatingProcessFileName in~ ("iexplore.exe", "runtimebroker.exe", "chrome.exe") 
  | where ProcessCommandLine has "--gpu-launcher"  
  | summarize FirstEvent=min(Timestamp), LastEvent=max(Timestamp) by DeviceName, ProcessCommandLine, FileName, InitiatingProcessFileName