examples:
- description: "Place malicious dbgcore.dll in the search order location"
command: "copy malicious.dll "%PROGRAMFILES%\windows kits\10\debuggers\arm\dbgcore.dll""
- description: "Execute the vulnerable binary to trigger the hijack"
command: ""%SYSTEM32%\deploymentcsphelper.exe""
dbgcore.dll
Vendor: Microsoft
Expected Location: %PROGRAMFILES%\windows kits\10\debuggers\arm
Vulnerable Executables:
- %SYSTEM32%\deploymentcsphelper.exe (Sideloading)
- %SYSTEM32%\djoin.exe (Sideloading)
- %SYSTEM32%\dnscacheugc.exe (Sideloading)
- %SYSTEM32%\ieunatt.exe (Sideloading)
- %SYSTEM32%\muiunattend.exe (Sideloading)
- %SYSTEM32%\netbtugc.exe (Sideloading)
- %SYSTEM32%\netiougc.exe (Sideloading)
- %SYSTEM32%\pnpunattend.exe (Sideloading)
- %SYSTEM32%\setupugc.exe (Sideloading)
- %SYSTEM32%\systemreset.exe (Sideloading) [AutoElevate]
- %SYSTEM32%\werfault.exe (Sideloading)
- %SYSTEM32%\werfaultsecure.exe (Sideloading)
Acknowledgement: Wietze