atomic-red-team/atomics/T1118/T1118.md

T1118 - InstallUtil

Description from ATT&CK

InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) InstallUtil is located in the .NET directories on a Windows system: C:\Windows\Microsoft.NET\Framework\v\InstallUtil.exe and C:\Windows\Microsoft.NET\Framework64\v\InstallUtil.exe. InstallUtil.exe is digitally signed by Microsoft.

Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil may also be used to bypass process whitelisting through use of attributes within the binary that execute the class decorated with the attribute [System.ComponentModel.RunInstaller(true)]. (Citation: SubTee GitHub All The Things Application Whitelisting Bypass)

Detection: Use process monitoring to monitor the execution and arguments of InstallUtil.exe. Compare recent invocations of InstallUtil.exe with prior history of known good arguments and executed binaries to determine anomalous and potentially adversarial activity. Command arguments used before and after the InstallUtil.exe invocation may also be useful in determining the origin and purpose of the binary being executed.

Platforms: Windows

Data Sources: Process monitoring, Process command-line parameters

Defense Bypassed: Process whitelisting

Permissions Required: User

Remote Support: No

Contributors: Casey Smith, Travis Smith, Tripwire

Atomic Tests

• Atomic Test #1 - InstallUtil uninstall method call

Atomic Test #1 - InstallUtil uninstall method call

Executes the Uninstall Method

Supported Platforms: Windows

Inputs

Name	Description	Type	Default Value
filename	location of the payload	Path	T1118.dll

Run it with command_prompt!

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /target:library T1118.cs
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U #{filename}