Command Line
InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll
Description
Abuse installutil.exe to launch an arbitrary .NET-based DLL or EXE.
Risk
High
Risk Reason
Launching arbitrary DLL/EXE files via InstallUtil is a suspicious and abnormal activity.
Fidelity
High
Fidelity Reason
This type of commandline is typically rare in most organizations.
Operating Systems
Killchain Phases
References
MITRE ATT&CK TECHNIQUES
URL: https://attack.mitre.org/techniques/T1218/004
Description: Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: C:\Windows\Microsoft.NET\Framework\v\InstallUtil.exe and C:\Windows\Microsoft.NET\Framework64\v\InstallUtil.exe.
InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute [System.ComponentModel.RunInstaller(true)]. (Citation: LOLBAS Installutil)
Tactics: