examples:
- description: "Place malicious iertutil.dll in the search order location"
command: "copy malicious.dll "%SYSTEM32%\iertutil.dll""
- description: "Execute the vulnerable binary to trigger the hijack"
command: ""%SYSTEM32%\browserexport.exe""
iertutil.dll
Vendor: Microsoft
Expected Location: %SYSTEM32%
Vulnerable Executables:
- %SYSTEM32%\browserexport.exe (Sideloading)
- %SYSTEM32%\cipher.exe (Sideloading)
- %SYSTEM32%\iesettingsync.exe (Sideloading)
- %SYSTEM32%\launchwinapp.exe (Sideloading)
- %SYSTEM32%\microsoftedgebchost.exe (Sideloading)
- %SYSTEM32%\microsoftedgecp.exe (Sideloading)
- %SYSTEM32%\microsoftedgedevtools.exe (Sideloading)
- %SYSTEM32%\microsoftedgesh.exe (Sideloading)
- %SYSTEM32%\wwahost.exe (Sideloading)
Acknowledgement: Wietze
Acknowledgement: Chris Spehn