LOLBAS. GitHub
LIVING OFF THE LAND / OS LIBRARIES

Syssetup.dll

View source

Windows NT System Setup

AWL BypassExecute
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
02DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

AWL Bypass1

EXAMPLE 01T1218.011

Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified).

COMMAND
rundll32 syssetup.dll,SetupInfObjectInstallAction DefaultInstall 128 {PATH_ABSOLUTE:.inf}
USE CASE
Run local or remote script(let) code through INF file specification (Note May pop an error window).
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · INF

Execute1

EXAMPLE 01T1218.011

Launch an executable file via the SetupInfObjectInstallAction function and .inf file section directive.

COMMAND
rundll32 syssetup.dll,SetupInfObjectInstallAction DefaultInstall 128 {PATH_ABSOLUTE:.inf}
USE CASE
Load an executable payload.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · INF
02 / ON DISK

Known paths

c:\windows\system32\syssetup.dll
c:\windows\syswow64\syssetup.dll
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

2 resources
REFERENCE IMPLEMENTATIONS

Code samples

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Pierre-Alexandre Braeken (Execute)@pabraeken
Matt harr0ey (Execute)@harr0ey
Jimmy (Scriptlet)@bohops