Title:
Process Proxy Execution Via Squirrel.EXE
Status:
test
Description:Detects the usage of the "Squirrel.exe" binary to execute arbitrary processes. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)
References:
-https://lolbas-project.github.io/lolbas/OtherMSBinaries/Squirrel/
-http://www.hexacorn.com/blog/2019/03/30/sqirrel-packages-manager-as-a-lolbin-a-k-a-many-electron-apps-are-lolbins-by-default/
-http://www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/
Author: Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community
Date: 2022-06-09
modified:2025-10-07
Tags:
- -'attack.execution'
- -'attack.stealth'
- -'attack.t1218'
Logsource:
- category: process_creation
- product: windows
Detection:
selection_img:
Image|endswith:
-'\squirrel.exe'
-'\update.exe'
selection_exec:
CommandLine|contains:
-'--processStart'
-'--processStartAndWait'
-'--createShortcut'
filter_optional_discord:
CommandLine|contains|all:
-':\Users\'
-'\AppData\Local\Discord\Update.exe'
-'Discord.exe'
CommandLine|contains:
-'--createShortcut'
-'--processStart'
filter_optional_github_desktop:
CommandLine|contains|all:
-':\Users\'
-'\AppData\Local\GitHubDesktop\Update.exe'
-'GitHubDesktop.exe'
CommandLine|contains:
-'--createShortcut'
-'--processStartAndWait'
filter_optional_teams:
CommandLine|contains|all:
-':\Users\'
-'\AppData\Local\Microsoft\Teams\Update.exe'
-'Teams.exe'
CommandLine|contains:
-'--processStart'
-'--createShortcut'
filter_optional_yammer:
CommandLine|contains|all:
-':\Users\'
-'\AppData\Local\yammerdesktop\Update.exe'
-'Yammer.exe'
CommandLine|contains:
-'--processStart'
-'--createShortcut'
condition:
all of selection_* and not 1 of filter_optional_*
Falsepositives:
-Expected FP with some Electron based applications such as (1Clipboard, Beaker Browser, Caret, Discord, GitHub Desktop, etc.)
Level:
medium
