{"id":"1e75c1cc-c5d4-42aa-ac3d-91b0b68b3b4c","title":"Arbitrary File Download Via Squirrel.EXE","description":"Detects the usage of the \"Squirrel.exe\" to download arbitrary files. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)\n","author":"Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community","status":"test","level":"medium","date":"2022-06-09","modified":"2023-11-09","tags":["attack.execution","attack.stealth","attack.t1218"],"technique_ids":["T1218"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Expected FP with some Electron based applications such as (1Clipboard, Beaker Browser, Caret, Discord, GitHub Desktop, etc.)"],"references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Squirrel/","http://www.hexacorn.com/blog/2019/03/30/sqirrel-packages-manager-as-a-lolbin-a-k-a-many-electron-apps-are-lolbins-by-default/","http://www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/"],"source_path":"rules/windows/process_creation/proc_creation_win_squirrel_download.yml","source_sha256":"5da1a0f573025d9fd59159aed2fe8dbbd7b6b50c276e0897fea6663bd12353f9","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_squirrel_download.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Arbitrary File Download Via Squirrel.EXE\nid: 1e75c1cc-c5d4-42aa-ac3d-91b0b68b3b4c\nrelated:\n    - id: 45239e6a-b035-4aaf-b339-8ad379fcb67e\n      type: similar\n    - id: fa4b21c9-0057-4493-b289-2556416ae4d7\n      type: obsolete\nstatus: test\ndescription: |\n    Detects the usage of the \"Squirrel.exe\" to download arbitrary files. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)\nreferences:\n    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Squirrel/\n    - http://www.hexacorn.com/blog/2019/03/30/sqirrel-packages-manager-as-a-lolbin-a-k-a-many-electron-apps-are-lolbins-by-default/\n    - http://www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/\nauthor: Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community\ndate: 2022-06-09\nmodified: 2023-11-09\ntags:\n    - attack.execution\n    - attack.stealth\n    - attack.t1218\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        Image|endswith:\n            - '\\squirrel.exe'\n            - '\\update.exe'\n    selection_download_cli:\n        CommandLine|contains:\n            - ' --download '\n            - ' --update '\n            - ' --updateRollback='\n    selection_download_http_keyword:\n        CommandLine|contains: 'http'\n    condition: all of selection_*\nfalsepositives:\n    - Expected FP with some Electron based applications such as (1Clipboard, Beaker Browser, Caret, Discord, GitHub Desktop, etc.)\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1218","id":"T1218","name":"System Binary Proxy Execution","page":"techniques/enterprise/T1218/"}],"data_path":"data/detection-rules/1e75c1cc-c5d4-42aa-ac3d-91b0b68b3b4c.json","kind":"sigma"}