System Binary Proxy Execution: InstallUtil
- ID
- T1218.004
- Tactics
- TA0005 Stealth
- Sub-technique of
- T1218 System Binary Proxy Execution
- Platforms
- Windows
- Data sources
- Command Execution, Process Creation, File Creation, Module Load
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. [1] The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: C:\Windows\Microsoft.NET\Framework\v<version>\InstallUtil.exe and C:\Windows\Microsoft.NET\Framework64\v<version>\InstallUtil.exe.
InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute [System.ComponentModel.RunInstaller(true)]. [2]
Detection
- DET0138 Detection of Malicious Code Execution via InstallUtil.exe
Data components: Command Execution, Process Creation, File Creation, Module Load
Mitigations (2)
- M1038 Execution Prevention
Use application control configured to block execution of InstallUtil.exe if it is not required for a given system or network to prevent potential misuse by adversaries.
- M1042 Disable or Remove Feature or Program
InstallUtil may not be necessary within a given environment.