examples:
- description: "Place malicious d2d1.dll in the search order location"
command: "copy malicious.dll "%SYSTEM32%\d2d1.dll""
- description: "Execute the vulnerable binary to trigger the hijack"
command: ""%SYSTEM32%\dataexchangehost.exe""
d2d1.dll
Vendor: Microsoft
Expected Location: %SYSTEM32%
Vulnerable Executables:
- %SYSTEM32%\dataexchangehost.exe (Sideloading)
- %SYSTEM32%\dwm.exe (Sideloading)
- %SYSTEM32%\eoaexperiences.exe (Sideloading)
- %SYSTEM32%\gamepanel.exe (Sideloading)
- %SYSTEM32%\quickassist.exe (Sideloading)
- %SYSTEM32%\vsgraphicsdesktopengine.exe (Sideloading)
- %SYSTEM32%\vsgraphicsremoteengine.exe (Sideloading)
Acknowledgement: Wietze
Acknowledgement: Chris Spehn