.. / Setupapi.dll
Star

Windows Setup Application Programming Interface


Paths:


Resources:
https://github.com/huntresslabs/evading-autoruns
https://twitter.com/pabraeken/status/994742106852941825
https://windows10dll.nirsoft.net/setupapi_dll.html

Acknowledgement:
Kyle Hanslovan (COM Scriptlet) - @KyleHanslovan
Huntress Labs (COM Scriptlet) - @HuntressLabs
Casey Smith (COM Scriptlet) - @subTee
Nick Carr (Threat Intel) - @ItsReallyNick


Detection:



AWL bypass

Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified).
rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Tools\shady.inf
Usecase:
Privileges required:User
OS:Windows
Mitre:T1085



Execute

Launch an executable file via the InstallHinfSection function and .inf file section directive.
rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 C:\\Tools\\calc_exe.inf
Usecase:
Privileges required:User
OS:Windows
Mitre:T1085