Process Proxy Execution Via Squirrel.EXE
Detects the usage of the "Squirrel.exe" or "Update.exe" binaries to execute arbitrary processes, often seen with Electron-based applications like Slack, Teams, and Discord. This technique can be abused by adversaries for defense evasion and execution.
Sigma
