examples:
- description: "Place malicious uxtheme.dll in the search order location"
command: "copy malicious.dll "%SYSTEM32%\uxtheme.dll""
- description: "Execute the vulnerable binary to trigger the hijack"
command: ""%SYSTEM32%\atbroker.exe""
uxtheme.dll
Vendor: Microsoft
Expected Location: %SYSTEM32%
Vulnerable Executables:
- %SYSTEM32%\atbroker.exe (Sideloading)
- %SYSTEM32%\cloudnotifications.exe (Sideloading)
- %SYSTEM32%\cttune.exe (Sideloading)
- %SYSTEM32%\displayswitch.exe (Sideloading)
- %SYSTEM32%\ehstorauthn.exe (Sideloading)
- %SYSTEM32%\filehistory.exe (Sideloading)
- %SYSTEM32%\gamepanel.exe (Sideloading)
- %SYSTEM32%\isoburn.exe (Sideloading)
- %SYSTEM32%\mblctr.exe (Sideloading)
- %SYSTEM32%\mmc.exe (Sideloading)
- %SYSTEM32%\msdt.exe (Sideloading) [AutoElevate]
- %SYSTEM32%\msra.exe (Sideloading)
- %SYSTEM32%\musnotifyicon.exe (Sideloading)
- %SYSTEM32%\passwordonwakesettingflyout.exe (Sideloading)
- %SYSTEM32%\quickassist.exe (Sideloading)
- %SYSTEM32%\recoverydrive.exe (Sideloading)
- %SYSTEM32%\sdclt.exe (Sideloading) [AutoElevate]
- %SYSTEM32%\sethc.exe (Sideloading)
- %SYSTEM32%\sndvol.exe (Sideloading)
- %SYSTEM32%\snippingtool.exe (Sideloading)
- %SYSTEM32%\taskmgr.exe (Sideloading) [AutoElevate]
- %SYSTEM32%\wfs.exe (Sideloading)
- %SYSTEM32%\wiaacmgr.exe (Sideloading)
- %SYSTEM32%\wiawow64.exe (Sideloading)
- %SYSTEM32%\wmpdmc.exe (Sideloading)
- %PROGRAMFILES%\KeePass Password Safe 2\KeePass.exe (Search Order)
Acknowledgement: Wietze
Acknowledgement: Chris Spehn
Acknowledgement: Skrix