InfDefaultInstall.exe .inf Execution
This rule detects the execution of 'InfDefaultInstall.exe' with an '.inf' file specified on the command line. This behavior is commonly abused by adversaries to proxy execution of malicious code, often to bypass application whitelisting or other security controls. The tool 'InfDefaultInstall.exe' is a legitimate Windows binary used to install INF files, but it can be leveraged to execute commands embedded within a specially crafted INF file, including SCT scripts via 'scrobj.dll'.
Sigma
