diff --git a/Windows/Execution/InstallUtil.md b/Windows/Execution/InstallUtil.md index 3cd2a2ad..88c67472 100644 --- a/Windows/Execution/InstallUtil.md +++ b/Windows/Execution/InstallUtil.md @@ -6,11 +6,10 @@ MITRE ATT&CK Technique: [T1118](https://attack.mitre.org/wiki/Technique/T1118) Input: - x86 - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll + x86 - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U InstallUtilBypass.dll - x64 - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll + x64 - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U InastallUtilBypass.dll ## Test Script [InstallUtilBypass.cs](https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Payloads/InstallUtilBypass.cs) -