examples:
- description: "Place malicious secur32.dll in the search order location"
command: "copy malicious.dll "%SYSTEM32%\secur32.dll""
- description: "Execute the vulnerable binary to trigger the hijack"
command: ""%SYSTEM32%\appvclient.exe""
secur32.dll
Vendor: Microsoft
Expected Location: %SYSTEM32%
Vulnerable Executables:
- %SYSTEM32%\appvclient.exe (Sideloading)
- %SYSTEM32%\calc.exe (Sideloading)
- %SYSTEM32%\certreq.exe (Sideloading)
- %SYSTEM32%\certutil.exe (Sideloading)
- %SYSTEM32%\computerdefaults.exe (Sideloading) [AutoElevate]
- %SYSTEM32%\dfsrdiag.exe (Sideloading)
- %SYSTEM32%\dsregcmd.exe (Sideloading)
- %SYSTEM32%\dsrm.exe (Sideloading)
- %SYSTEM32%\fodhelper.exe (Sideloading) [AutoElevate]
- %SYSTEM32%\gpresult.exe (Sideloading)
- %SYSTEM32%\klist.exe (Sideloading)
- %SYSTEM32%\msdt.exe (Sideloading)
- %SYSTEM32%\repadmin.exe (Sideloading)
- %SYSTEM32%\consent.exe (Sideloading)
- %SYSTEM32%\compmgmtlauncher.exe (Search Order)
- %LOCALAPPDATA%\microsoft\onedrive%VERSION%\microsoft.sharepoint.exe (Search Order)
Acknowledgement: Wietze
Acknowledgement: Chris Spehn
Acknowledgement: Matthew Hickey