Setupapi.dll

Windows Setup Application Programming Interface

AWL Bypass

Run local or remote script(let) code through INF file specification.

rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 {PATH_ABSOLUTE:.inf}

Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified). — MITRE: T1218.011 — Privileges: User

Execute

Load an executable payload.

rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 {PATH_ABSOLUTE:.inf}

Launch an executable file via the InstallHinfSection function and .inf file section directive. — MITRE: T1218.011 — Privileges: User