windows enabled community high v1.0.0

syssetup

Windows NT System Setup Located at: c:\windows\system32\syssetup.dll; c:\windows\syswow64\syssetup.dll.

📋 Live Preview 
syssetup
syssetup

Sandbox: execFile · Timeout: 30s

Capabilities

security.defense-evasion.bypass
security.execution.command

Contract

Outputs

process.output

Command execution output

Side effects: process_spawn

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networklow
Disk I/Olow

Examples

Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified). (Run local or remote script(let) code through INF file specification (Note May pop an error window).)

rundll32 syssetup.dll,SetupInfObjectInstallAction DefaultInstall 128 {PATH_ABSOLUTE:.inf}

Launch an executable file via the SetupInfObjectInstallAction function and .inf file section directive. (Load an executable payload.)

rundll32 syssetup.dll,SetupInfObjectInstallAction DefaultInstall 128 {PATH_ABSOLUTE:.inf}

Detection

TypeRule / Indicator
sigma https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml
splunk https://github.com/splunk/security_content/blob/86a5b644a44240f01274c8b74d19a435c7dae66e/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml

Documentation

syssetup

syssetup is a Windows LOLBin. Windows NT System Setup Located at: c:\windows\system32\syssetup.dll; c:\windows\syswow64\syssetup.dll.

References