examples:
- description: "Place malicious ncrypt.dll in the search order location"
command: "copy malicious.dll "%SYSTEM32%\ncrypt.dll""
- description: "Execute the vulnerable binary to trigger the hijack"
command: ""%SYSTEM32%\certreq.exe""
ncrypt.dll
Vendor: Microsoft
Expected Location: %SYSTEM32%
Vulnerable Executables:
- %SYSTEM32%\certreq.exe (Sideloading)
- %SYSTEM32%\certutil.exe (Sideloading)
- %SYSTEM32%\clipup.exe (Sideloading)
- %SYSTEM32%\dmcertinst.exe (Sideloading)
- %SYSTEM32%\dnscmd.exe (Sideloading)
- %SYSTEM32%\dsregcmd.exe (Sideloading)
- %SYSTEM32%\filehistory.exe (Environment Variable)
- %SYSTEM32%\sgrmbroker.exe (Sideloading)
Acknowledgement: Wietze
Acknowledgement: Chris Spehn