LOLBAS. GitHub
LIVING OFF THE LAND / OS LIBRARIES

Setupapi.dll

View source

Windows Setup Application Programming Interface

AWL BypassExecute
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
03DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

AWL Bypass1

EXAMPLE 01T1218.011

Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified).

COMMAND
rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 {PATH_ABSOLUTE:.inf}
USE CASE
Run local or remote script(let) code through INF file specification.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · INF

Execute1

EXAMPLE 01T1218.011

Launch an executable file via the InstallHinfSection function and .inf file section directive.

COMMAND
rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 {PATH_ABSOLUTE:.inf}
USE CASE
Load an executable payload.
PRIVILEGES
User
OPERATING SYSTEM
Windows
Execute · INF
02 / ON DISK

Known paths

c:\windows\system32\setupapi.dll
c:\windows\syswow64\setupapi.dll
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

3 resources
REFERENCE IMPLEMENTATIONS

Code samples

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Kyle Hanslovan (COM Scriptlet)@KyleHanslovan
Huntress Labs (COM Scriptlet)@HuntressLabs
Casey Smith (COM Scriptlet)@subTee
Nick Carr (Threat Intel)@ItsReallyNick