System Binary Proxy Execution: InstallUtil

Created the Saturday 04 March 2023. Updated 6 months, 3 weeks ago.

Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: C:\Windows\Microsoft.NET\Framework\v\InstallUtil.exe and C:\Windows\Microsoft.NET\Framework64\v\InstallUtil.exe.

InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute [System.ComponentModel.RunInstaller(true)].

Technique Identifier

T1218.004

Technique Tags

Defense Evasion C:\Windows\Microsoft.NET\Framework\v\InstallUtil.exe C:\Windows\Microsoft.NET\Framework64\v\InstallUtil.exe [System.ComponentModel.RunInstaller(true)] disable Windows Defender execute malicious code

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

System Binary Proxy Execution: InstallUtil, Sub-technique T1218.004 - Enterprise | MITRE ATT&CK®