Teams.exe

Classic Microsoft Teams is an Electron/Chromium app, and the Chromium --gpu-launcher switch runs an arbitrary command as a child of the signed Teams binary (system binary proxy execution / parent masquerading). The same abuse applies to other Electron apps, and Teams can also be made to run planted JavaScript from its app.asar/package.json.

Use Proxy-execute a command under a trusted, signed Electron binary to blend with normal process trees.

Teams.exe --disable-gpu-sandbox --gpu-launcher="C:\Windows\Temp\x.exe &&"

Context

user

Native

Execute

MITRE

T1218.015

Detection

Detection: Teams.exe (or any Electron app) launched with --gpu-launcher/--disable-gpu-sandbox/--utility-cmd-prefix; Teams.exe spawning cmd.exe/powershell.exe; unexpected writes to app.asar or package.json under %LOCALAPPDATA%\Microsoft\Teams.

Verified

✓ LOLBAS Teams.yml quotes `teams.exe --disable-gpu-sandbox --gpu-launcher="{CMD} &&"` and the app.asar/package.json JavaScript variants, all MitreID T1218.015 (Electron Applications); match.

Refs

github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OtherMSBinaries/Teams.yml

attack.mitre.org/techniques/T1218/015/