.. /Shdocvw.dll

Star

Shell Doc Object and Control Library.

• http://www.hexacorn.com/blog/2018/03/15/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline-part-5/
• https://bohops.com/2018/03/17/abusing-exported-functions-and-exposed-dcom-interfaces-for-pass-thru-command-execution-and-lateral-movement/
• https://twitter.com/bohops/status/997690405092290561
• https://windows10dll.nirsoft.net/shdocvw_dll.html

Execute

1. Launch an executable payload via proxy through a URL (information) file by calling OpenURL.

   rundll32.exe shdocvw.dll,OpenURL "C:\test\calc.url"

   Use case

   Load an executable payload by calling a .url file with or without quotes. The .url file extension can be renamed.

   Privileges required

   User

   Operating systems

   Windows 10, Windows 11

   ATT&CK® technique

   T1218.011