Ieadvpack.dll

Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified).

Use Run local or remote script(let) code through INF file specification.

rundll32.exe ieadvpack.dll,LaunchINFSection {PATH_ABSOLUTE:.inf},DefaultInstall_SingleUser,1,

Evidence

Upstream reference

Environment

Local host

Context

user

Native

AWL Bypass

MITRE

T1218.011

Detection

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml

Splunk: github.com/splunk/security_content/blob/86a5b644a44240f01274c8b74d19a435c7dae66e/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml

Refs

bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/

twitter.com/pabraeken/status/991695411902599168

twitter.com/0rbz_/status/974472392012689408

lolbas-project.github.io/lolbas/Libraries/Ieadvpack/

Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (DefaultInstall section implied).

Use Run local or remote script(let) code through INF file specification.

rundll32.exe ieadvpack.dll,LaunchINFSection {PATH_ABSOLUTE:.inf},,1,

Evidence

Upstream reference

Environment

Local host

Context

user

Native

AWL Bypass

MITRE

T1218.011

Detection

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml

Splunk: github.com/splunk/security_content/blob/86a5b644a44240f01274c8b74d19a435c7dae66e/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml

Refs

bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/

twitter.com/pabraeken/status/991695411902599168

twitter.com/0rbz_/status/974472392012689408

lolbas-project.github.io/lolbas/Libraries/Ieadvpack/

Launch a DLL payload by calling the RegisterOCX function.

Use Load a DLL payload.

rundll32.exe ieadvpack.dll,RegisterOCX {PATH:.dll}

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Execute

MITRE

T1218.011

Detection

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml

Splunk: github.com/splunk/security_content/blob/86a5b644a44240f01274c8b74d19a435c7dae66e/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml

Refs

bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/

twitter.com/pabraeken/status/991695411902599168

twitter.com/0rbz_/status/974472392012689408

lolbas-project.github.io/lolbas/Libraries/Ieadvpack/

Launch an executable by calling the RegisterOCX function.

Use Run an executable payload.

rundll32.exe ieadvpack.dll,RegisterOCX {PATH:.exe}

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Execute

MITRE

T1218.011

Detection

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml

Splunk: github.com/splunk/security_content/blob/86a5b644a44240f01274c8b74d19a435c7dae66e/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml

Refs

bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/

twitter.com/pabraeken/status/991695411902599168

twitter.com/0rbz_/status/974472392012689408

lolbas-project.github.io/lolbas/Libraries/Ieadvpack/

Launch command line by calling the RegisterOCX function.

Use Run an executable payload.

rundll32 ieadvpack.dll, RegisterOCX {CMD}

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Execute

MITRE

T1218.011

Detection

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml

Splunk: github.com/splunk/security_content/blob/86a5b644a44240f01274c8b74d19a435c7dae66e/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml

Refs

bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/

twitter.com/pabraeken/status/991695411902599168

twitter.com/0rbz_/status/974472392012689408

lolbas-project.github.io/lolbas/Libraries/Ieadvpack/