Blog | G5 Cyber Security

Leveraging INF-SCT Fetch & Execute Techniques For Bypass, Evasion, & Persistence

LaunchINFSection is a new method to remotely launch staged SCT files configured within INF configuration files. It is a method within the Advanced INF Package Installer (advpack.dll) that is used to invoke a particular section within a setup information (.inf) file. In the administrative sense, INF files are typically used as an instruction file for the installation of device drivers and/or Windows Cabinet (.cab) files, which may include registering Windows binaries (Ex, dll, ocx), adding keys to the registry, and specifying critical parameter settings.”]

Source: https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/

Exit mobile version