Process Proxy Execution Via Squirrel.EXE

detection:
  filter_optional_discord:
    CommandLine|contains:
      - '--createShortcut'
      - '--processStart'
    CommandLine|contains|all:
      - ':\Users\'
      - '\AppData\Local\Discord\Update.exe'
      - 'Discord.exe'
  filter_optional_github_desktop:
    CommandLine|contains:
      - '--createShortcut'
      - '--processStartAndWait'
    CommandLine|contains|all:
      - ':\Users\'
      - '\AppData\Local\GitHubDesktop\Update.exe'
      - 'GitHubDesktop.exe'
  filter_optional_teams:
    CommandLine|contains:
      - '--processStart'
      - '--createShortcut'
    CommandLine|contains|all:
      - ':\Users\'
      - '\AppData\Local\Microsoft\Teams\Update.exe'
      - 'Teams.exe'
  filter_optional_yammer:
    CommandLine|contains:
      - '--processStart'
      - '--createShortcut'
    CommandLine|contains|all:
      - ':\Users\'
      - '\AppData\Local\yammerdesktop\Update.exe'
      - 'Yammer.exe'
  selection_exec:
    CommandLine|contains:
      - '--processStart'
      - '--processStartAndWait'
      - '--createShortcut'
  selection_img:
    Image|endswith:
      - '\squirrel.exe'
      - '\update.exe'
  condition: all of selection_* and not 1 of filter_optional_*

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

The commands LOLBAS or GTFOBins documents for update.exe trip it: each is on its program’s page, read by CmdID.