Process Proxy Execution Via Squirrel.EXE

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community
Source: github.com/SigmaHQ/sigma

Detects the usage of the "Squirrel.exe" binary to execute arbitrary processes. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)

Known false positives

Expected FP with some Electron based applications such as (1Clipboard, Beaker Browser, Caret, Discord, GitHub Desktop, etc.)

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1218` System Binary Proxy Execution

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Process Proxy Execution Via Squirrel.EXE
id: 45239e6a-b035-4aaf-b339-8ad379fcb67e
related:
    - id: 1e75c1cc-c5d4-42aa-ac3d-91b0b68b3b4c
      type: similar
    - id: fa4b21c9-0057-4493-b289-2556416ae4d7
      type: obsolete
status: test
description: |
    Detects the usage of the "Squirrel.exe" binary to execute arbitrary processes. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)
references:
    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Squirrel/
    - http://www.hexacorn.com/blog/2019/03/30/sqirrel-packages-manager-as-a-lolbin-a-k-a-many-electron-apps-are-lolbins-by-default/
    - http://www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/
author: Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community
date: 2022-06-09
modified: 2025-10-07
tags:
    - attack.execution
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\squirrel.exe'
            - '\update.exe'
    selection_exec:
        CommandLine|contains:
            - '--processStart'
            - '--processStartAndWait'
            - '--createShortcut'
    filter_optional_discord:
        CommandLine|contains|all:
            - ':\Users\'
            - '\AppData\Local\Discord\Update.exe'
            - 'Discord.exe'
        CommandLine|contains:
            - '--createShortcut'
            - '--processStart'
    filter_optional_github_desktop:
        CommandLine|contains|all:
            - ':\Users\'
            - '\AppData\Local\GitHubDesktop\Update.exe'
            - 'GitHubDesktop.exe'
        CommandLine|contains:
            - '--createShortcut'
            - '--processStartAndWait'
    filter_optional_teams:
        CommandLine|contains|all:
            - ':\Users\'
            - '\AppData\Local\Microsoft\Teams\Update.exe'
            - 'Teams.exe'
        CommandLine|contains:
            - '--processStart'
            - '--createShortcut'
    filter_optional_yammer:
        CommandLine|contains|all:
            - ':\Users\'
            - '\AppData\Local\yammerdesktop\Update.exe'
            - 'Yammer.exe'
        CommandLine|contains:
            - '--processStart'
            - '--createShortcut'
    condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
    - Expected FP with some Electron based applications such as (1Clipboard, Beaker Browser, Caret, Discord, GitHub Desktop, etc.)
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_* and not 1 of filter_optional_*

Stage 1: `selection_img`

selection_img:
    Image|endswith:
        - '\squirrel.exe'
        - '\update.exe'

Stage 2: `selection_exec`

selection_exec:
    CommandLine|contains:
        - '--processStart'
        - '--processStartAndWait'
        - '--createShortcut'

Stage 3: `not filter_optional_*`

filter_optional_discord:
    CommandLine|contains|all:
        - ':\Users\'
        - '\AppData\Local\Discord\Update.exe'
        - 'Discord.exe'
    CommandLine|contains:
        - '--createShortcut'
        - '--processStart'
filter_optional_github_desktop:
    CommandLine|contains|all:
        - ':\Users\'
        - '\AppData\Local\GitHubDesktop\Update.exe'
        - 'GitHubDesktop.exe'
    CommandLine|contains:
        - '--createShortcut'
        - '--processStartAndWait'
filter_optional_teams:
    CommandLine|contains|all:
        - ':\Users\'
        - '\AppData\Local\Microsoft\Teams\Update.exe'
        - 'Teams.exe'
    CommandLine|contains:
        - '--processStart'
        - '--createShortcut'
filter_optional_yammer:
    CommandLine|contains|all:
        - ':\Users\'
        - '\AppData\Local\yammerdesktop\Update.exe'
        - 'Yammer.exe'
    CommandLine|contains:
        - '--processStart'
        - '--createShortcut'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`CommandLine`	match	`--createShortcut`	`excludes:CommandLine` `field:"CommandLine" value:"--createShortcut"`
`CommandLine`	match	`--processStart`	`excludes:CommandLine` `field:"CommandLine" value:"--processStart"`
`CommandLine`	match	`:\Users\`	`excludes:CommandLine` `field:"CommandLine" value:":\Users\"`
`CommandLine`	match	`Discord.exe`	`excludes:CommandLine` `field:"CommandLine" value:"Discord.exe"`
`CommandLine`	match	`\AppData\Local\Discord\Update.exe`	`excludes:CommandLine` `field:"CommandLine" value:"\AppData\Local\Discord\Update.exe"`
`CommandLine`	match	`Teams.exe`	`excludes:CommandLine` `field:"CommandLine" value:"Teams.exe"`
`CommandLine`	match	`\AppData\Local\Microsoft\Teams\Update.exe`	`excludes:CommandLine` `field:"CommandLine" value:"\AppData\Local\Microsoft\Teams\Update.exe"`
`CommandLine`	match	`Yammer.exe`	`excludes:CommandLine` `field:"CommandLine" value:"Yammer.exe"`
`CommandLine`	match	`\AppData\Local\yammerdesktop\Update.exe`	`excludes:CommandLine` `field:"CommandLine" value:"\AppData\Local\yammerdesktop\Update.exe"`
`CommandLine`	match	`--processStartAndWait`	`excludes:CommandLine` `field:"CommandLine" value:"--processStartAndWait"`
`CommandLine`	match	`GitHubDesktop.exe`	`excludes:CommandLine` `field:"CommandLine" value:"GitHubDesktop.exe"`
`CommandLine`	match	`\AppData\Local\GitHubDesktop\Update.exe`	`excludes:CommandLine` `field:"CommandLine" value:"\AppData\Local\GitHubDesktop\Update.exe"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`--createShortcut` `--processStart` `--processStartAndWait`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\squirrel.exe` corpus 2 (sigma 2) `\update.exe` corpus 2 (sigma 2)	`field:"Image" kind:ends_with`