T1218.015sub-technique of T1218 System Binary Proxy Execution

Electron Applications

Linux · macOS · Windowsnothing on this site yetT1218.015 on attack.mitre.org

Adversaries may abuse components of the Electron framework to execute malicious code. The Electron framework hosts many common applications such as Signal, Slack, and Microsoft Teams. Originally developed by GitHub, Electron is a cross-platform desktop application development framework that employs web technologies like JavaScript, HTML, and CSS. The Chromium engine is used to display web content and Node.js runs the backend code.
MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detecting Electron Application Abuse for Proxy Execution

Abuse of trusted Electron apps (Teams, Slack, Chrome) to spawn child processes or execute payloads via malicious command-line arguments (e.g., --gpu-launcher) and modified app resources (.asar).
Abuse of Linux Electron binaries by modifying app.asar or config JS files and spawning unexpected child processes (bash, curl, python).
Abuse of macOS Electron apps by modifying app.asar bundles and spawning child processes (osascript, curl, sh) from Electron executables.

what reduces it

M1038 Execution Prevention. Where possible, enforce binary and application integrity with digital signature verification to prevent untrusted code from executing. For example, do not use `shell.openExternal` with untrusted content. Where possible, set `nodeIntegration` to false, which disables access to the Node.js function.
M1050 Exploit Protection. Microsoft's Enhanced Mitigation Experience Toolkit (EMET) Attack Surface Reduction (ASR) feature can be used to block methods of using trusted binaries to bypass application control. Ensure that Electron is updated to the latest version and critical vulnerabilities (such as nodeIntegration bypasses) are patched and cannot be exploited.
M1042 Disable or Remove Feature or Program. Remove or deny access to unnecessary and potentially vulnerable software and features to prevent abuse by adversaries. Many native binaries may not be necessary within a given environment: for example, consider disabling the Node.js integration in all renderers that display remote content to protect users by limiting adversaries’ power to plant malicious JavaScript within Electron applications.

the rest of T1218

T1218.001 Compiled HTML File · not covered yet
T1218.002 Control Panel · not covered yet
T1218.003 CMSTP · not covered yet
T1218.004 InstallUtil · not covered yet
T1218.005 Mshta · not covered yet
T1218.007 Msiexec · not covered yet
T1218.008 Odbcconf · not covered yet
T1218.009 Regsvcs/Regasm · not covered yet
T1218.010 Regsvr32 · not covered yet
T1218.011 Rundll32 · 1 on this site
T1218.012 Verclsid · not covered yet
T1218.013 Mavinject · not covered yet
T1218.014 MMC · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.