Process Proxy Execution Via Squirrel.EXE (45239e6a-b035-4aaf-b339-8ad379fcb67e)
Detects the usage of the "Squirrel.exe" binary to execute arbitrary processes. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Process Proxy Execution Via Squirrel.EXE (45239e6a-b035-4aaf-b339-8ad379fcb67e) | Sigma-Rules | System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4) | Attack Pattern | 1 |