Cross-source coverage
T1118 / ATT&CK
InstallUtil
ATT&CK has retired this technique. Rules still tag it; the current id is T1218.004 System Binary Proxy Execution: InstallUtil.
2 rules · 1 family across 1 source.
1 deprecated hidden · include
From MITRE ATT&CK 19.2
InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in.NET binaries. InstallUtil is located in the.NET directories on a Windows system: C:\Windows\Microsoft.NET\Framework\v\InstallUtil.exe and C:\Windows\Microsoft.NET\Framework64\v\InstallUtil.exe. InstallUtil.exe is digitally signed by Microsoft.
Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil may also be used to bypass process whitelisting through use of attributes within the binary that execute the class decorated with the attribute [System.ComponentModel.RunInstaller(true)].
- Platforms
- Windows
- Telemetry
- —
socfortress/Wazuh-Rules
2 rules · 1 family| Detection | Severity | Format |
|---|---|---|
| Sysmon - Event 1: Process creation · InstallUtil (T1118) 2 variants | Low | Wazuh XML |
| Sysmon - Event 1: Process creation · InstallUtil (T1118) 2 variants | Low | Wazuh XML |