The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies
InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll
Execute the target .NET DLL or EXE.
Use to execute code and bypass application whitelisting
C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe, C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe, C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe, C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_instalutil_no_log_execution.yml, Sigma: https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_installutil_download.yml, Elastic: https://github.com/elastic/detection-rules/blob/cc241c0b5ec590d76cb88ec638d3cc37f68b5d50/rules/windows/defense_evasion_installutil_beacon.toml, Elastic: https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_network_connection_from_windows_binary.toml
Casey Smith (@subtee), Nir Chako (Pentera) (@C_h4ck_0)