T1218.004 — InstallUtil

Tactic: Stealth · Platforms: Windows

Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. The InstallUtil binary may also be…

Sub-technique of System Binary Proxy Execution (T1218).

Sigma detection rules (1)

T1218.004 System Binary Proxy Execution: InstallUtil

title: "T1218.004 System Binary Proxy Execution: InstallUtil"
id: fbffdef2-7b22-4b2e-b4b9-bfee7915579d
description: 'Detection of Malicious Code Execution via InstallUtil.exe. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: InstallUtilPathRegex, AssemblyPathRegex, ChildProcessList, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1218/004
author: Shahrukh Khan
date: 2026-01-16
license: MIT
tags:
  - attack.stealth
  - attack.t1218.004

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith: '\InstallUtil.exe'
    CommandLine|contains|all:
      - '/logfile='
      - '/LogToConsole=false'
      - '/U'

  condition: selection

falsepositives:
  - Rare in modern environments; some legacy deployment/uninstall automation may combine these switches for logging suppression during scripted uninstalls.

level: high

Related sub-techniques

Explore