Windows NT System Setup
rundll32.exe syssetup.dll,SetupInfObjectInstallAction DefaultInstall 128 c:\test\shady.inf
Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified).
Run local or remote script(let) code through INF file specification (Note May pop an error window).
c:\windows\system32\syssetup.dll, c:\windows\syswow64\syssetup.dll
Sigma: https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml, Splunk: https://github.com/splunk/security_content/blob/86a5b644a44240f01274c8b74d19a435c7dae66e/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml
Pierre-Alexandre Braeken (Execute) (@pabraeken), Matt harr0ey (Execute) (@harr0ey), Jimmy (Scriptlet) (@bohops)