MITRE ATT&CKsub-technique
T1218.004 InstallUtil
- Domain
- enterprise
- Tactics
- Stealth
- Platforms
- Windows
- Version
- 3.0
- Created
- 2020-01-23
Description
Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: C:\Windows\Microsoft.NET\Framework\v\InstallUtil.exe and C:\Windows\Microsoft.NET\Framework64\v\InstallUtil.exe.
InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute [System.ComponentModel.RunInstaller(true)].
Related
Subtechnique of · MITRE ATT&CK (1)
- T1218 System Binary Proxy Execution technique
Tactic · MITRE ATT&CK (1)
- TA0005 Stealth tactic
Referenced by MITRE ATT&CK · mitigates (2)
Referenced by MITRE ATT&CK · uses (6)
Referenced by Compliance · mitigates (12)
- CIS-2.5 Allowlist Authorized Software CIS Safeguard v8.1
- NIST-CM-11 User-installed Software NIST 800-53 control
- NIST-CM-2 Baseline Configuration NIST 800-53 control
- NIST-CM-6 Configuration Settings NIST 800-53 control
- NIST-CM-7 Least Functionality NIST 800-53 control
- NIST-CM-8 System Component Inventory NIST 800-53 control
- NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
- NIST-SI-10 Information Input Validation NIST 800-53 control
- NIST-SI-16 Memory Protection NIST 800-53 control
- NIST-SI-3 Malicious Code Protection NIST 800-53 control
- NIST-SI-4 System Monitoring NIST 800-53 control
- NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control
References
- https://lolbas-project.github.io/lolbas/Binaries/Installutil/ LOLBAS Installutil
- https://msdn.microsoft.com/en-us/library/50614e95.aspx MSDN InstallUtil