Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1218.004sub-technique of T1218 System Binary Proxy Execution

InstallUtil

Windowsnothing on this site yetT1218.004 on attack.mitre.org

Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in.NET binaries.

MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detection of Malicious Code Execution via InstallUtil.exe

  • Execution of InstallUtil.exe from.NET framework directories with arguments specifying non-standard or attacker-supplied assemblies, especially when followed by suspicious child process creation or script execution.

what reduces it

  • M1038 Execution Prevention. Use application control configured to block execution of InstallUtil.exe if it is not required for a given system or network to prevent potential misuse by adversaries.
  • M1042 Disable or Remove Feature or Program. InstallUtil may not be necessary within a given environment.

the rest of T1218

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.