Suspicious Execution of InstallUtil Without Log

calendar Sep 3, 2026 · attack.stealth  ·
Share on: linkedin copy

Uses the .NET InstallUtil.exe application in order to execute image without log

Sigma rule (View on GitHub)

 1title: Suspicious Execution of InstallUtil Without Log
 2id: d042284c-a296-4988-9be5-f424fadcc28c
 3status: test
 4description: Uses the .NET InstallUtil.exe application in order to execute image without log
 5references:
 6    - https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/
 7    - https://learn.microsoft.com/en-us/dotnet/framework/tools/installutil-exe-installer-tool
 8author: frack113
 9date: 2022-01-23
10modified: 2022-02-04
11tags:
12    - attack.stealth
13logsource:
14    category: process_creation
15    product: windows
16detection:
17    selection:
18        Image|endswith: '\InstallUtil.exe'
19        Image|contains: 'Microsoft.NET\Framework'
20        CommandLine|contains|all:
21            - '/logfile= '
22            - '/LogToConsole=false'
23    condition: selection
24falsepositives:
25    - Unknown
26level: medium
27regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_instalutil_no_log_execution/info.yml

References

Related rules

to-top