Detect InstallUtil in IBM QRadar
Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. The InstallUtil binary is digitally signed by Microsoft and located in the .NET directories. InstallUtil may also bypass application control by using the [System.ComponentModel.RunInstaller(true)] attribute decorator pattern. Known users of this technique include Mustang Panda (Beacon stager), WhisperGate (Windows Defender disable), Chaes malware, Saint Bot, and the Covenant C2 framework.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1218 System Binary Proxy Execution
- Sub-technique
- T1218.004 InstallUtil
- Canonical reference
- https://attack.mitre.org/techniques/T1218/004/
QRadar Detection Query
SELECT
DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
LOGSOURCENAME(logsourceid) AS log_source,
sourceip,
username,
"Process Name" AS process_name,
"Command" AS command_line,
"Parent Process Name" AS parent_process_name,
CASE WHEN REGEXP_LIKE(LOWER("Command"), '(temp|appdata|downloads|public|programdata|\\\\users\\\\)') THEN 1 ELSE 0 END AS suspicious_path,
CASE WHEN REGEXP_LIKE(LOWER("Parent Process Name"), '(cmd|powershell|wscript|cscript|mshta|winword|excel)\.exe') THEN 1 ELSE 0 END AS suspicious_parent,
CASE WHEN REGEXP_LIKE(LOWER("Command"), '(/u |/uninstall|/logfile)') THEN 1 ELSE 0 END AS suspicious_flag,
QIDNAME(qid) AS event_name,
CATEGORYNAME(category) AS category_name
FROM events
WHERE
(
LOWER("Process Name") LIKE '%installutil.exe'
OR LOWER("Parent Process Name") LIKE '%installutil.exe'
)
AND
(
REGEXP_LIKE(LOWER("Command"), '(temp|appdata|downloads|public|programdata|\\\\users\\\\)') = TRUE
OR REGEXP_LIKE(LOWER("Parent Process Name"), '(cmd|powershell|wscript|cscript|mshta|winword|excel)\.exe') = TRUE
OR REGEXP_LIKE(LOWER("Command"), '(/u |/uninstall|/logfile)') = TRUE
OR LOWER("Parent Process Name") LIKE '%installutil.exe'
)
LAST 24 HOURSDetects T1218.004 InstallUtil proxy execution in IBM QRadar AQL by querying parsed Windows Sysmon or Security event fields. Matches InstallUtil invocations or child processes of InstallUtil with scoring for suspicious paths, interpreter parents, uninstall flags, and suspicious child processes. Field names assume Sysmon DSM parsing; adjust to match site-specific QRadar DSM property names.
Data Sources
Required Tables
False Positives & Tuning
- Automated deployment jobs run by SCCM, Ansible, or Intune that call InstallUtil from a PowerShell or cmd.exe parent process as part of a legitimate .NET package installation workflow
- CI/CD build agents on Windows where MSBuild or Cake Build scripts stage assemblies in a TEMP or user AppData path and then invoke InstallUtil for component registration
- IT helpdesk-driven repair operations that run InstallUtil with /u or /uninstall to remove and re-register corrupt .NET services, which will score positively on the suspicious_flag field
Other platforms for T1218.004
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1InstallUtil Execution from Temp Directory
Expected signal: Sysmon Event ID 1: installutil.exe with Temp path in command line, /logfile and /logtoconsole flags. Security Event ID 4688 for the process. Sysmon Event ID 7 (Image Load) for the DLL being loaded.
- Test 2InstallUtil with Uninstall Flag
Expected signal: Sysmon Event ID 1: installutil.exe with /u flag and temp path. Security Event ID 4688. The process will fail if the file doesn't exist or isn't a valid installer assembly, but the process creation event still fires.
- Test 3InstallUtil Invoked from PowerShell
Expected signal: Sysmon Event ID 1: powershell.exe followed by installutil.exe with ParentImage=powershell.exe. Both SuspiciousParent and SuspiciousPath indicators fire. Security Event ID 4688 for both processes.
References (7)
- https://attack.mitre.org/techniques/T1218/004/
- https://lolbas-project.github.io/lolbas/Binaries/Installutil/
- https://msdn.microsoft.com/en-us/library/50614e95.aspx
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
- https://unit42.paloaltonetworks.com/attackers-tactics-and-techniques-in-unsecured-docker-daemons-revealed/
- https://www.cybereason.com/blog/operation-cobalt-kitty-apt
- https://www.anomali.com/blog/mustang-panda-threat-actor-targets-minority-groups-journalists-and-activists
Unlock Pro Content
Get the full detection package for T1218.004 including response playbook, investigation guide, and atomic red team tests.