{"id":"45239e6a-b035-4aaf-b339-8ad379fcb67e","title":"Process Proxy Execution Via Squirrel.EXE","description":"Detects the usage of the \"Squirrel.exe\" binary to execute arbitrary processes. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)\n","author":"Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community","status":"test","level":"medium","date":"2022-06-09","modified":"2025-10-07","tags":["attack.execution","attack.stealth","attack.t1218"],"technique_ids":["T1218"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Expected FP with some Electron based applications such as (1Clipboard, Beaker Browser, Caret, Discord, GitHub Desktop, etc.)"],"references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Squirrel/","http://www.hexacorn.com/blog/2019/03/30/sqirrel-packages-manager-as-a-lolbin-a-k-a-many-electron-apps-are-lolbins-by-default/","http://www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/"],"source_path":"rules/windows/process_creation/proc_creation_win_squirrel_proxy_execution.yml","source_sha256":"18f0314cb48d82b21006cf8fbaf49d3902f137f69ecea78ad0bc932f99921aba","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_squirrel_proxy_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Process Proxy Execution Via Squirrel.EXE\nid: 45239e6a-b035-4aaf-b339-8ad379fcb67e\nrelated:\n    - id: 1e75c1cc-c5d4-42aa-ac3d-91b0b68b3b4c\n      type: similar\n    - id: fa4b21c9-0057-4493-b289-2556416ae4d7\n      type: obsolete\nstatus: test\ndescription: |\n    Detects the usage of the \"Squirrel.exe\" binary to execute arbitrary processes. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)\nreferences:\n    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Squirrel/\n    - http://www.hexacorn.com/blog/2019/03/30/sqirrel-packages-manager-as-a-lolbin-a-k-a-many-electron-apps-are-lolbins-by-default/\n    - http://www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/\nauthor: Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community\ndate: 2022-06-09\nmodified: 2025-10-07\ntags:\n    - attack.execution\n    - attack.stealth\n    - attack.t1218\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        Image|endswith:\n            - '\\squirrel.exe'\n            - '\\update.exe'\n    selection_exec:\n        CommandLine|contains:\n            - '--processStart'\n            - '--processStartAndWait'\n            - '--createShortcut'\n    filter_optional_discord:\n        CommandLine|contains|all:\n            - ':\\Users\\'\n            - '\\AppData\\Local\\Discord\\Update.exe'\n            - 'Discord.exe'\n        CommandLine|contains:\n            - '--createShortcut'\n            - '--processStart'\n    filter_optional_github_desktop:\n        CommandLine|contains|all:\n            - ':\\Users\\'\n            - '\\AppData\\Local\\GitHubDesktop\\Update.exe'\n            - 'GitHubDesktop.exe'\n        CommandLine|contains:\n            - '--createShortcut'\n            - '--processStartAndWait'\n    filter_optional_teams:\n        CommandLine|contains|all:\n            - ':\\Users\\'\n            - '\\AppData\\Local\\Microsoft\\Teams\\Update.exe'\n            - 'Teams.exe'\n        CommandLine|contains:\n            - '--processStart'\n            - '--createShortcut'\n    filter_optional_yammer:\n        CommandLine|contains|all:\n            - ':\\Users\\'\n            - '\\AppData\\Local\\yammerdesktop\\Update.exe'\n            - 'Yammer.exe'\n        CommandLine|contains:\n            - '--processStart'\n            - '--createShortcut'\n    condition: all of selection_* and not 1 of filter_optional_*\nfalsepositives:\n    - Expected FP with some Electron based applications such as (1Clipboard, Beaker Browser, Caret, Discord, GitHub Desktop, etc.)\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1218","id":"T1218","name":"System Binary Proxy Execution","page":"techniques/enterprise/T1218/"}],"data_path":"data/detection-rules/45239e6a-b035-4aaf-b339-8ad379fcb67e.json","kind":"sigma"}