Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. [1] The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: C:\Windows\Microsoft.NET\Framework\v and C:\Windows\Microsoft.NET\Framework64\v.
InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute [System.ComponentModel.RunInstaller(true)]. [2]
| ID | Name | Description |
|---|---|---|
| S0631 | Chaes | |
| S1155 | Covenant |
Covenant can create launchers via an InstallUtil XML file to install new Grunt listeners.[4] |
| G0045 | menuPass |
menuPass has used |
| G0129 | Mustang Panda |
Mustang Panda has used |
| S1018 | Saint Bot |
Saint Bot had used |
| S0689 | WhisperGate |
WhisperGate has used |
| ID | Mitigation | Description |
|---|---|---|
| M1042 | Disable or Remove Feature or Program |
InstallUtil may not be necessary within a given environment. |
| M1038 | Execution Prevention |
Use application control configured to block execution of InstallUtil.exe if it is not required for a given system or network to prevent potential misuse by adversaries. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0138 | Detection of Malicious Code Execution via InstallUtil.exe | AN0388 |
Execution of InstallUtil.exe from .NET framework directories with arguments specifying non-standard or attacker-supplied assemblies, especially when followed by suspicious child process creation or script execution. Detection also includes correlation of newly created binaries prior to InstallUtil invocation and anomalous command-line usage compared to historical baselines. |