InfDefaultInstall.exe.md

InfDefaultInstall.exe

InfDefaultInstall.exe Infdefaultinstall.inf
Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file.

• Windows binary: True

• Bypasses Default AppLocker Rules: False

• Mitre: T1218

• Links:

  • https://twitter.com/KyleHanslovan/status/911997635455852544
  • https://gist.github.com/KyleHanslovan/5e0f00d331984c1fb5be32c40f3b265a
  • https://blog.conscioushacker.io/index.php/2017/10/25/evading-microsofts-autoruns/
  • https://medium.com/@KyleHanslovan/re-evading-autoruns-pocs-on-windows-10-dd810d7e8a3f

• File path:

  • C:\Windows\System32\Infdefaultinstall.exe
  • C:\Windows\SysWOW64\Infdefaultinstall.exe

• Acknowledgement:

  • Name: Kyle Hanslovan
    • Twitter: @kylehanslovan
    • Blog: https://medium.com/@KyleHanslovan

OS: