LOL · Library

Syssetup.dll

2 techniques WindowsLOLBAS GPL-3.0

AWL Bypass

AWL / Policy Bypass Windows

Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified).

Use Run local or remote script(let) code through INF file specification (Note May pop an error window).

rundll32 syssetup.dll,SetupInfObjectInstallAction DefaultInstall 128 {PATH_ABSOLUTE:.inf}

Context: user
Native: AWL Bypass
MITRE: T1218.011
Detection: Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml
Splunk: github.com/splunk/security_content/blob/86a5b644a44240f01274c8b74d19a435c7dae66e/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml
Refs: twitter.com/pabraeken/status/994392481927258113
twitter.com/harr0ey/status/975350238184697857
twitter.com/bohops/status/975549525938135040
windows10dll.nirsoft.net/syssetup_dll.html
lolbas-project.github.io/lolbas/Libraries/Syssetup/

Execute

Execution Windows

Launch an executable file via the SetupInfObjectInstallAction function and .inf file section directive.

Use Load an executable payload.

rundll32 syssetup.dll,SetupInfObjectInstallAction DefaultInstall 128 {PATH_ABSOLUTE:.inf}

Context: user
Native: Execute
MITRE: T1218.011
Detection: Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml
Splunk: github.com/splunk/security_content/blob/86a5b644a44240f01274c8b74d19a435c7dae66e/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml
Refs: twitter.com/pabraeken/status/994392481927258113
twitter.com/harr0ey/status/975350238184697857
twitter.com/bohops/status/975549525938135040
windows10dll.nirsoft.net/syssetup_dll.html
lolbas-project.github.io/lolbas/Libraries/Syssetup/