windows enabled community high v1.0.0

setupapi

Windows Setup Application Programming Interface Located at: c:\windows\system32\setupapi.dll; c:\windows\syswow64\setupapi.dll.

📋 Live Preview 
setupapi
setupapi

Sandbox: execFile · Timeout: 30s

Capabilities

security.defense-evasion.bypass
security.execution.command

Contract

Outputs

process.output

Command execution output

Side effects: process_spawn

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networklow
Disk I/Olow

Examples

Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified). (Run local or remote script(let) code through INF file specification.)

rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 {PATH_ABSOLUTE:.inf}

Launch an executable file via the InstallHinfSection function and .inf file section directive. (Load an executable payload.)

rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 {PATH_ABSOLUTE:.inf}

Detection

TypeRule / Indicator
sigma https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_rundll32_setupapi_installhinfsection.yml
sigma https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml
splunk https://github.com/splunk/security_content/blob/86a5b644a44240f01274c8b74d19a435c7dae66e/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml

Documentation

setupapi

setupapi is a Windows LOLBin. Windows Setup Application Programming Interface Located at: c:\windows\system32\setupapi.dll; c:\windows\syswow64\setupapi.dll.

References