Nasreddine Bencherchali
73 lines
2.6 KiB
YAML
73 lines
2.6 KiB
YAML
title: Use of Squirrel.exe
|
|
id: 45239e6a-b035-4aaf-b339-8ad379fcb67e
|
|
related:
|
|
- id: fa4b21c9-0057-4493-b289-2556416ae4d7
|
|
type: obsoletes
|
|
status: experimental
|
|
description: Detects the usage of the "Squirrel.exe" binary as a LOLBIN. This binary is part of multiple software installations (Slack, Teams, Discord, etc.)
|
|
references:
|
|
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Squirrel/
|
|
- http://www.hexacorn.com/blog/2019/03/30/sqirrel-packages-manager-as-a-lolbin-a-k-a-many-electron-apps-are-lolbins-by-default/
|
|
- http://www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/
|
|
author: Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community
|
|
date: 2022/06/09
|
|
modified: 2023/03/22
|
|
tags:
|
|
- attack.defense_evasion
|
|
- attack.execution
|
|
- attack.t1218
|
|
logsource:
|
|
category: process_creation
|
|
product: windows
|
|
detection:
|
|
selection_img:
|
|
Image|endswith:
|
|
- '\squirrel.exe'
|
|
- '\update.exe'
|
|
selection_download_cli:
|
|
CommandLine|contains:
|
|
- ' --download '
|
|
- ' --update '
|
|
- ' --updateRollback='
|
|
selection_download_http_keyword:
|
|
CommandLine|contains: 'http'
|
|
selection_exec:
|
|
CommandLine|contains:
|
|
- '--processStart'
|
|
- '--processStartAndWait'
|
|
- '--createShortcut'
|
|
filter_discord:
|
|
CommandLine|contains|all:
|
|
- 'C:\Users\'
|
|
- '\AppData\Local\Discord\Update.exe'
|
|
- ' --processStart'
|
|
- 'Discord.exe'
|
|
filter_github_desktop:
|
|
CommandLine|contains|all:
|
|
- 'C:\Users\'
|
|
- '\AppData\Local\GitHubDesktop\Update.exe'
|
|
- 'GitHubDesktop.exe'
|
|
CommandLine|contains:
|
|
- '--createShortcut'
|
|
- '--processStartAndWait'
|
|
filter_teams:
|
|
CommandLine|contains|all:
|
|
- 'C:\Users\'
|
|
- '\AppData\Local\Microsoft\Teams\Update.exe'
|
|
- 'Teams.exe'
|
|
CommandLine|contains:
|
|
- '--processStart'
|
|
- '--createShortcut'
|
|
filter_yammer:
|
|
CommandLine|contains|all:
|
|
- 'C:\Users\'
|
|
- '\AppData\Local\yammerdesktop\Update.exe'
|
|
- 'Yammer.exe'
|
|
CommandLine|contains:
|
|
- '--processStart'
|
|
- '--createShortcut'
|
|
condition: selection_img and (all of selection_download_* or selection_exec) and not 1 of filter_*
|
|
falsepositives:
|
|
- Expected FP with some electron based applications such as (1Clipboard, Beaker Browser, Caret, Discord, GitHub Desktop,...Etc)
|
|
level: medium
|