Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1218.015_electron-applications
Adversaries may abuse components of the Electron framework to execute malicious code.
Passed 22 of 23 test cases with the skill, and 14 of 23 without it.
and 5 more in the full report
8 fixed14 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
How many primary detection strategies are listed in the T1218.015 technique documentation for detecting Electron application abuse?
| Checked | Without skill | With skill |
|---|---|---|
| States that there is 1 primary detection strategy. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1218
Adversaries may abuse components of the Electron framework to execute malicious code. The Electron framework hosts many common applications such as Signal, Slack, and Microsoft Teams. Originally developed by GitHub, Electron is a cross-platform desktop application development framework that employs web technologies like JavaScript, HTML, and CSS. The Chromium engine is used to display web content and Node.js runs the backend code.
Due to the functional mechanics of Electron (such as allowing apps to run arbitrary commands), adversaries may also be able to perform malicious functions in the background potentially disguised as legitimate tools within the framework. For example, the abuse of teams.exe and chrome.exe may allow adversaries to execute malicious commands as child processes of the legitimate application (e.g., chrome.exe --disable-gpu-sandbox --gpu-launcher="C:\Windows\system32\cmd.exe /c calc.exe).
Adversaries may also execute malicious content by planting malicious JavaScript within Electron applications.
Platforms: Linux, macOS, Windows
Identify Attack Surface: Determine if the target environment is susceptible to Electron Applications by examining the target platforms (Linux, macOS, Windows).
Assess Existing Defenses: Review whether mitigations for T1218.015 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 14 / 23 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.