DCOM Again: Installing Trouble

The report presents a DCOM lateral movement technique leveraging the Windows Installer Custom Action server to trigger execution of attacker-controlled DLLs by abusing ODBC driver installation and configuration (SQLInstallDriverEx and SQLConfigDriver), with execution occurring under msiexec in the target user context. It includes reverse engineering insights into MSI/COM interfaces, a released Beacon Object File to operationalize the method locally or remotely with valid credentials, and defensive guidance to monitor ODBC-related registry changes that indicate driver installation.