LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Infdefaultinstall.exe

View source

Binary used to perform installation based on content inside inf files

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
02DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1218

Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file.

COMMAND
InfDefaultInstall.exe {PATH:.inf}
USE CASE
Code execution
PRIVILEGES
Admin
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · INF
02 / ON DISK

Known paths

C:\Windows\System32\Infdefaultinstall.exe
C:\Windows\SysWOW64\Infdefaultinstall.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

2 resources
REFERENCE IMPLEMENTATIONS

Code samples

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Kyle Hanslovan@kylehanslovan