Setupapi.dll

Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified).

Use Run local or remote script(let) code through INF file specification.

rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 {PATH_ABSOLUTE:.inf}

Context

user

Native

AWL Bypass

MITRE

T1218.011

Detection

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_rundll32_setupapi_installhinfsection.yml

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml

Splunk: github.com/splunk/security_content/blob/86a5b644a44240f01274c8b74d19a435c7dae66e/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml

Refs

github.com/huntresslabs/evading-autoruns

twitter.com/pabraeken/status/994742106852941825

windows10dll.nirsoft.net/setupapi_dll.html

lolbas-project.github.io/lolbas/Libraries/Setupapi/

Launch an executable file via the InstallHinfSection function and .inf file section directive.

Use Load an executable payload.

rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 {PATH_ABSOLUTE:.inf}

Context

user

Native

Execute

MITRE

T1218.011

Detection

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_rundll32_setupapi_installhinfsection.yml

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml

Splunk: github.com/splunk/security_content/blob/86a5b644a44240f01274c8b74d19a435c7dae66e/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml

Refs

github.com/huntresslabs/evading-autoruns

twitter.com/pabraeken/status/994742106852941825

windows10dll.nirsoft.net/setupapi_dll.html

lolbas-project.github.io/lolbas/Libraries/Setupapi/