bohops Leveraging INF-SCT Fetch & Execute Techniques For Bypass, Evasion, & Persistence

Detect capabilities in executable files and identify potential behaviors.

In recent weeks, I have conducted research and testing on several intriguing namespaces and methods that are documented across various Microsoft and MSDN sources. These methods pertain to the execution of different COM scripts and scriptlets, such as VBScript and JScript. My main focus was to investigate potential new methods for invoking remote scripts, specifically ActiveX Objects. This exploration builds upon the excellent research that has already been conducted and documented by @subTee, @Oddvarmoe, @ItsReallyNick, @KyleHanslovan, @ChrisBisnett, and @NickTyrer.

We discovered several intriguing findings, but the most significant was the identification of LaunchINFSection, a ‘new’ method for remotely launching staged SCT files that are configured within INF files. In this post, we will explore various known methods for launching INF-SCT files, introduce LaunchINFSection, and examine its use cases along with defensive considerations. Furthermore, we will reference additional techniques for executing remote scripts and scriptlets. INF-SCT Launch Methods There are several methods available for launching script component files ('.sct') through INF configuration files. These include InstallHinfSection (setupapi.dll), CMSTP, and LaunchINFSection (advpack.dll). Let’s take a closer look… Malicious INF-SCT Usage with Infected INF Files.