Process Proxy Execution Via Squirrel.EXE

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects the usage of the "Squirrel.exe" binary to execute arbitrary processes. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)