LOLBAS. GitHub
LIVING OFF THE LAND / OS LIBRARIES

Advpack.dll

View source

Utility for installing software and drivers with rundll32.exe

AWL BypassExecute
05COMMAND EXAMPLES
01ATT&CK TECHNIQUES
02DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

5 examples

AWL Bypass2

EXAMPLE 01T1218.011

Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified).

COMMAND
rundll32.exe advpack.dll,LaunchINFSection {PATH:.inf},DefaultInstall_SingleUser,1,
USE CASE
Run local or remote script(let) code through INF file specification.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · INF
EXAMPLE 02T1218.011

Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (DefaultInstall section implied).

COMMAND
rundll32.exe advpack.dll,LaunchINFSection {PATH:.inf},,1,
USE CASE
Run local or remote script(let) code through INF file specification.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · INF

Execute3

EXAMPLE 01T1218.011

Launch a DLL payload by calling the RegisterOCX function.

COMMAND
rundll32.exe advpack.dll,RegisterOCX {PATH:.dll}
USE CASE
Load a DLL payload.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · DLL
EXAMPLE 02T1218.011

Launch an executable by calling the RegisterOCX function.

COMMAND
rundll32.exe advpack.dll,RegisterOCX {PATH:.exe}
USE CASE
Run an executable payload.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · EXE
EXAMPLE 03T1218.011

Launch command line by calling the RegisterOCX function.

COMMAND
rundll32 advpack.dll, RegisterOCX {CMD}
USE CASE
Run an executable payload.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · CMD
02 / ON DISK

Known paths

c:\windows\system32\advpack.dll
c:\windows\syswow64\advpack.dll
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

2 resources
REFERENCE IMPLEMENTATIONS

Code samples

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Jimmy (LaunchINFSection)@bohops
Fabrizio (RegisterOCX - DLL)@0rbz_
Moriarty (RegisterOCX - CMD)@moriarty_meng
Nick Carr (Threat Intel)@ItsReallyNick