Forensia CTI Core

About

Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: <code>C:\Windows\Microsoft.NET\Framework\v<version>\InstallUtil.exe</code> and <code>C:\Windows\Microsoft.NET\Framework64\v<version>\InstallUtil.exe</code>. InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute <code>[System.ComponentModel.RunInstaller(true)]</code>.

Platforms: WindowsParent: T1218 System Binary Proxy ExecutionMITRE ATT&CK ↗

Used by actors

2 known groups

G0045 menuPass G0129 Mustang Panda

Software

4 malware/tools implement this

ChaesWhisperGateSaint BotCovenant

Corpus indicators tagged with this technique

158 indicators in the corpus carry T1218.004.

Indicator	Type	Family	Sev	Src
5b95e1d05d913676e9ebbd897a403ddfa6476524651a038d08ecebde29159b9a	sha256	dependency_confusion	80	1
59a260716d05c20229c6a46fe0a2fb5b80fa30c9c73a850222d9d3454426a60a	sha256	ransomware	80	1
f1c3ebe78bd8c38559bf3cfcc9a9fa37d221e31780774a3787e26160a61f5348	hash	—	80	3
6ed15aec7504081c3e14a9f6064d7b754aa283e4adb1a59edf3beff65369bc55	sha256	dependency_confusion	80	1
adbc18f15019ef2ba6890b7996445c14350d57ba772eb33182889bc14ac47085	sha256	ransomware	80	1
607cb58b8a592885eef5cfbe35ddce962741b0775c575f58cb3a96ca0ee893a6	sha256	ransomware	80	1
3cbd65ae3ff5039324b03a66947a1d1b808ea5ddb09da917ed8f1323c34e80f7	sha256	dependency_confusion	80	1
7f53fade6f3942f710b230d52a574fc6066ea282e739e417ca039800dc1bb08e	sha256	dependency_confusion	80	1
4b7301f02b8312ae6de614981f325dbbabee32166630618fdff74615d9a487ba	sha256	ransomware	80	1
8d08136a1964c72b6b450b11d9bf2b3d3d289c26dfadfc9f021114eac2cea1ca	sha256	dependency_confusion	80	1
c356aff1a01c2b0da472e584c8e3c8f875b9a24280435d42836a77b19f5a8c18	hash	—	80	3
e3ec5926a167d6e3359f98cdfb7ac3b2cce97652843056505d02e6d2898573c6	sha256	ransomware	80	1
c725815cbb07ab5be8903e74ef8aea46ef9c25e4a3bc626ae94bfc1ae21df6e3	sha256	ransomware	80	1
b7d50d0406afcd2efd87bf3bf8c4211719ba9817dd2e0ad62af10c933e765e28	sha256	ransomware	80	1
c61b1941cf756eb7551f7c661743802362728b785adc22e860d269713dfb01a6	hash	—	80	3
d5b7247c497788cf0031ceb06e3df77a45fef59f1e49633dc7159816d64759b5	hash	—	80	3
e91fb249aa97be5c7931e430781167edfe7ba804720b5f643e6ab70b7e6e74dd	hash	—	80	3
b12b5720404e3d8794d72af064939dd953b6a8e0	sha1	dependency_confusion	78	1
c2679a152084f3ebdb39aacb6ec6a23c61a46ae6	sha1	dependency_confusion	78	1
d27fc9abbeccb60906d22906ef9a73bd05da2b7a	sha1	dependency_confusion	78	1
d497271a32633ddb4f56d548a13fefdab864b6e2	sha1	dependency_confusion	78	1
ce1349eb9d4b2025d1a0dde651a690c7a471c5b0	sha1	dependency_confusion	78	1
8f4e8b680d3e8d3f5ac39bd72882f713	md5	dependency_confusion	76	1
999a63730c9634481d1d76955a2e76a8	md5	dependency_confusion	76	1
edff4f58722c93d7c09ed71899416396	md5	dependency_confusion	76	1
695e794631ef130583368770e7b81e98	md5	dependency_confusion	76	1
87603ea025623b19954e460add532048	md5	dependency_confusion	76	1
83601c3d4ed28e8d2be1b99beb8ec18c	md5	dependency_confusion	76	1
73bead922109a61e5f9f85771a7812c5	md5	dependency_confusion	76	1
9a9ccd8b0e5d05f4ee77667b024844db	md5	dependency_confusion	76	1

Showing the top 30 by severity of 158.