Arbitrary File Download Via Squirrel.EXE (1e75c1cc-c5d4-42aa-ac3d-91b0b68b3b4c)
Detects the usage of the "Squirrel.exe" to download arbitrary files. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Arbitrary File Download Via Squirrel.EXE (1e75c1cc-c5d4-42aa-ac3d-91b0b68b3b4c) | Sigma-Rules | System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4) | Attack Pattern | 1 |