From 3ebbb99a3abe5a0121bc86812ca132c9b94ea51c Mon Sep 17 00:00:00 2001 From: caseysmithrc <30840394+caseysmithrc@users.noreply.github.com> Date: Mon, 7 May 2018 14:06:41 -0600 Subject: [PATCH] InstallUtil Test Update --- Windows/Execution/InstallUtil.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/Windows/Execution/InstallUtil.md b/Windows/Execution/InstallUtil.md index 3cd2a2ad..88c67472 100644 --- a/Windows/Execution/InstallUtil.md +++ b/Windows/Execution/InstallUtil.md @@ -6,11 +6,10 @@ MITRE ATT&CK Technique: [T1118](https://attack.mitre.org/wiki/Technique/T1118) Input: - x86 - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll + x86 - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U InstallUtilBypass.dll - x64 - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll + x64 - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U InastallUtilBypass.dll ## Test Script [InstallUtilBypass.cs](https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Payloads/InstallUtilBypass.cs) -