Cross-source coverage
T1218.004 / ATT&CK
System Binary Proxy Execution: InstallUtil
21 rules across 3 sources.
From MITRE ATT&CK 19.2
Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in.NET binaries. The InstallUtil binary may also be digitally signed by Microsoft and located in the.NET directories on a Windows system: C:\Windows\Microsoft.NET\Framework\v\InstallUtil.exe and C:\Windows\Microsoft.NET\Framework64\v\InstallUtil.exe.
InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute [System.ComponentModel.RunInstaller(true)].
- Tactics
- Stealth
- Platforms
- Windows
- Telemetry
-
WinEventLog:PowerShellWinEventLog:Sysmon
How MITRE says to detect it DET0138
Detection of Malicious Code Execution via InstallUtil.exe
Windows Analytic 0388
Execution of InstallUtil.exe from.NET framework directories with arguments specifying non-standard or attacker-supplied assemblies, especially when followed by suspicious child process creation or script execution. Detection also includes correlation of newly created binaries prior to InstallUtil invocation and anomalous command-line usage compared to historical baselines.
WinEventLog:PowerShellEventCode=4103, 4104, 4105, 4106WinEventLog:SysmonEventCode=1WinEventLog:SysmonEventCode=11WinEventLog:SysmonEventCode=7
elastic/detection-rules
9 rules| Detection | Severity | Format |
|---|---|---|
| Execution from Unusual Directory - Command Line | Medium | Elastic TOML |
| Execution of Persistent Suspicious Program | Medium | Elastic TOML |
| InstallUtil Process Making Network Connections | Medium | Elastic TOML |
| Suspicious JetBrains TeamCity Child Process | Medium | Elastic TOML |
| Suspicious MS Office Child Process | Medium | Elastic TOML |
| Unusual Network Activity from a Windows System Binary | Medium | Elastic TOML |
| Delayed Execution via Ping | Low | Elastic TOML |
| Suspicious MS Outlook Child Process | Low | Elastic TOML |
| Suspicious PDF Reader Child Process | Low | Elastic TOML |
elastic/protections-artifacts
6 rules| Detection | Severity | Format |
|---|---|---|
| Execution via a Suspicious WMI Client | Undefined | Elastic TOML |
| Inhibit System Recovery via Signed Binary Proxy | Undefined | Elastic TOML |
| Potential Evasion via ASP.NET Compiler | Undefined | Elastic TOML |
| Potential Evasion via dotNET Framework Installation Utility | Undefined | Elastic TOML |
| Suspicious Registry Modification via WMI | Undefined | Elastic TOML |
| Suspicious Windows Schedule Child Process | Undefined | Elastic TOML |
splunk/security_content
6 rules| Detection | Severity | Format |
|---|---|---|
| Windows DotNet Binary in Non Standard Path | Undefined | SPL |
| Windows InstallUtil Credential Theft | Undefined | SPL |
| Windows InstallUtil in Non Standard Path | Undefined | SPL |
| Windows InstallUtil Remote Network Connection | Undefined | SPL |
| Windows InstallUtil Uninstall Option | Undefined | SPL |
| Windows InstallUtil URL in Command Line | Undefined | SPL |