Binary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation.
Update.exe --processStart payload.exe --process-start-args "whatever args"
Copy your payload into %userprofile%\AppData\Local\Microsoft\Teams\current\. Then run the command. Update.exe will execute the file you copied.
Execute binary
%localappdata%\Microsoft\Teams\update.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_squirrel.yml, IOC: Update.exe spawned an unknown process
Reegun Richard Jayapaul (SpiderLabs, Trustwave) (@reegun21), Mr.Un1k0d3r (@MrUn1k0d3r), Adam (@Hexacorn), Jesus Galvez