Technique on mitre.org

T1218.004: InstallUtil

Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: C:\Windows\Microsoft.NET\Framework\v\InstallUtil.exe and C:\Windows\Microsoft.NET\Framework64\v\InstallUtil.exe.

InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute [System.ComponentModel.RunInstaller(true)].

Positive Technologies products that cover the technique

MaxPatrol SIEM knowledge base

mitre_attck_defense_evasion: PT-CR-195: InstallUtil_AWL_Bypass: An attempt to bypass application-start restrictions by using installutil.exe (a Microsoft Windows command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies)

Detection

ID	DS0009	Data source and component	Process: Process Creation	Description	Use process monitoring to monitor the execution and arguments of InstallUtil.exe. Compare recent invocations of InstallUtil.exe with prior history of known good arguments and executed binaries to determine anomalous and potentially adversarial activity

ID	DS0017	Data source and component	Command: Command Execution	Description	Monitor executed commands and arguments used before and after the InstallUtil.exe invocation may also be useful in determining the origin and purpose of the binary being executed.

ID	Data source and component	Description
DS0009	Process: Process Creation	Use process monitoring to monitor the execution and arguments of InstallUtil.exe. Compare recent invocations of InstallUtil.exe with prior history of known good arguments and executed binaries to determine anomalous and potentially adversarial activity
DS0017	Command: Command Execution	Monitor executed commands and arguments used before and after the InstallUtil.exe invocation may also be useful in determining the origin and purpose of the binary being executed.

Mitigation

ID	M1038	Name	Execution Prevention	Description	Use application control configured to block execution of InstallUtil.exe if it is not required for a given system or network to prevent potential misuse by adversaries.

ID	M1042	Name	Disable or Remove Feature or Program	Description	InstallUtil may not be necessary within a given environment.

ID	Name	Description
M1038	Execution Prevention	Use application control configured to block execution of InstallUtil.exe if it is not required for a given system or network to prevent potential misuse by adversaries.
M1042	Disable or Remove Feature or Program	InstallUtil may not be necessary within a given environment.