T1218.004 InstallUtil Mappings

Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) InstallUtil is digitally signed by Microsoft and located in the .NET directories on a Windows system: <code>C:\Windows\Microsoft.NET\Framework\v<version>\InstallUtil.exe</code> and <code>C:\Windows\Microsoft.NET\Framework64\v<version>\InstallUtil.exe</code>.

InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute <code>[System.ComponentModel.RunInstaller(true)]</code>. (Citation: LOLBAS Installutil)

View in MITRE ATT&CK®

Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
CM-2 Baseline Configuration Protects T1218.004 InstallUtil
CM-6 Configuration Settings Protects T1218.004 InstallUtil
CM-7 Least Functionality Protects T1218.004 InstallUtil
CM-8 System Component Inventory Protects T1218.004 InstallUtil
RA-5 Vulnerability Monitoring and Scanning Protects T1218.004 InstallUtil
SI-10 Information Input Validation Protects T1218.004 InstallUtil
SI-4 System Monitoring Protects T1218.004 InstallUtil
SI-7 Software, Firmware, and Information Integrity Protects T1218.004 InstallUtil
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1218.004 Signed Binary Proxy Execution: InstallUtil