tfMITRE ATT&CK sub-technique

InstallUtil T1218.004

sub-technique of T1218 System Binary Proxy Execution

Tactic: Stealth
Platform: Windows
Version: 3.0
Created: 23 January 2020
Last modified: 12 May 2026
Contributors: Casey Smith; Travis Smith, Tripwire

Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. [1] The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: <code>C:\Windows\Microsoft.NET\Framework\v<version>\InstallUtil.exe</code> and <code>C:\Windows\Microsoft.NET\Framework64\v<version>\InstallUtil.exe</code>.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups56th pct

Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware62nd pct

Tools & malware62nd percentile · 62% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules67th pct

Detection rules67th percentile · 67% of ATT&CK techniques have this many detection rules written or fewer.

InstallUtil MITRE reference T1218.004

56th pctamong all ATT&CK techniques for number of groups

2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Mustang PandaG0129 ↗

Has used InstallUtil.exe to execute a malicious Beacon stager.1

created 2021-04-121 referenceaka TA416

menuPassG0045 ↗

Has used InstallUtil.exe to execute malicious software.1

created 2017-05-311 referenceaka Cicada

All 2 groups for this technique

4 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

CovenantS1155 ↗

Can create launchers via an InstallUtil XML file to install new Grunt listeners.1

created 2024-09-04TOOLcarried by 1 group

Saint BotS1018 ↗

Had used InstallUtil.exe to download and deploy executables.1

created 2022-06-09MALWAREcarried by 2 groups

WhisperGateS0689 ↗

Has used InstallUtil.exe as part of its process to disable Windows Defender.1

created 2022-03-10MALWAREcarried by 1 group

ChaesS0631 ↗

Has used Installutill to download content.1

created 2021-06-30MALWARE

All 4 software entries for this technique

Offense vs defense T1218.004

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 6

first rule: 2021 Q4

InstallUtil detection strategy DET0138

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Malicious Code Execution via InstallUtil.exe

Enterprise

1 platform

AN0388 · Windows

Execution of InstallUtil.exe from .NET framework directories with arguments specifying non-standard or attacker-supplied assemblies, especially when followed by suspicious child process creation or script execution. Detection also includes correlation of newly created binaries prior to InstallUtil invocation and anomalous command-line usage compared to historical baselines.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
InstallUtilPathRegex	Regex pattern for InstallUtil.exe in .NET directories; tune to exclude known good administrative scripts
AssemblyPathRegex	Patterns for identifying suspicious assemblies (e.g., in temp folders, user profiles)
ChildProcessList	List of suspicious child processes spawned from InstallUtil.exe (e.g., cmd.exe, powershell.exe, rundll32.exe)
TimeWindow	Time correlation window between file creation of assembly and its execution via InstallUtil.exe

Tests8ExecutorsPowerShell 8Need elevation0 of 8Have prerequisites8Have cleanup8Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

CheckIfInstallable method call

windows

PowerShell

—

Yes

Executes the CheckIfInstallable class constructor runner instead of executing InstallUtil. Upon execution, the InstallUtil test harness will be executed. If no output is displayed the test executed successfuly.

Input arguments

Name	Type	Default	Description
assembly_dir	path	$Env:TEMP\	directory to drop the compiled installer assembly
test_harness	path	PathToAtomicsFolder\T1218.004\src\InstallUtilTestHarness.ps1	location of the test harness script - Invoke-BuildAndInvokeInstallUtilAssembly
assembly_filename	string	T1218.004.dll	filename of the compiled installer assembly
invocation_method	string	CheckIfInstallable	the type of InstallUtil invocation variant - Executable, InstallHelper, or CheckIfInstallable

Attack command

# Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly
. "#{test_harness}"

$InstallerAssemblyDir = "#{assembly_dir}"
$InstallerAssemblyFileName = "#{assembly_filename}"
$InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName

$ExpectedOutput = 'Constructor_'

$TestArgs = @{
    OutputAssemblyDirectory = $InstallerAssemblyDir
    OutputAssemblyFileName = $InstallerAssemblyFileName
    InvocationMethod = '#{invocation_method}'
}

$ActualOutput = Invoke-BuildAndInvokeInstallUtilAssembly @TestArgs -MinimumViableAssembly

if ($ActualOutput -ne $ExpectedOutput) {
    throw @"
CheckIfInstallable method execution test failure. Installer assembly execution output did not match the expected output.
Expected: $ExpectedOutput
Actual: $ActualOutput
"@
}

Cleanup command

$InstallerAssemblyDir = "#{assembly_dir}"
$InstallerAssemblyFileName = "#{assembly_filename}"
$InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName
Remove-Item -Path $InstallerAssemblyFullPath -ErrorAction Ignore

Prerequisite

InstallUtil test harness script must be installed at specified location (#{test_harness})

Check

if (Test-Path "#{test_harness}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{test_harness}") -ErrorAction ignore | Out-Null
Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.004/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}"

GUIDff607b2e-abb8-41af-a4bf-4d4c72a88bf2

InstallHelper method call

windows

PowerShell

—

Yes

Executes the InstallHelper class constructor runner instead of executing InstallUtil. Upon execution, no output will be displayed if the test executed successfuly.

Input arguments

Name	Type	Default	Description
assembly_dir	path	$Env:TEMP\	directory to drop the compiled installer assembly
test_harness	path	PathToAtomicsFolder\T1218.004\src\InstallUtilTestHarness.ps1	location of the test harness script - Invoke-BuildAndInvokeInstallUtilAssembly
assembly_filename	string	T1218.004.dll	filename of the compiled installer assembly
invocation_method	string	InstallHelper	the type of InstallUtil invocation variant - Executable, InstallHelper, or CheckIfInstallable

Attack command

# Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly
. "#{test_harness}"

$InstallerAssemblyDir = "#{assembly_dir}"
$InstallerAssemblyFileName = "#{assembly_filename}"
$InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName

$CommandLine = "/logfile= /logtoconsole=false `"$InstallerAssemblyFullPath`""
$ExpectedOutput = 'Constructor_'

$TestArgs = @{
    OutputAssemblyDirectory = $InstallerAssemblyDir
    OutputAssemblyFileName = $InstallerAssemblyFileName
    InvocationMethod = '#{invocation_method}'
    CommandLine = $CommandLine
}

$ActualOutput = Invoke-BuildAndInvokeInstallUtilAssembly @TestArgs -MinimumViableAssembly

if ($ActualOutput -ne $ExpectedOutput) {
    throw @"
InstallHelper method execution test failure. Installer assembly execution output did not match the expected output.
Expected: $ExpectedOutput
Actual: $ActualOutput
"@
}

Cleanup command

$InstallerAssemblyDir = "#{assembly_dir}"
$InstallerAssemblyFileName = "#{assembly_filename}"
$InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName
Remove-Item -Path $InstallerAssemblyFullPath -ErrorAction Ignore

Prerequisite

InstallUtil test harness script must be installed at specified location (#{test_harness})

Check

if (Test-Path "#{test_harness}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{test_harness}") -ErrorAction ignore | Out-Null
Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.004/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}"

GUIDee9b6dde-a7bb-4527-a7a5-93b487b6114b

InstallUtil class constructor method call

windows

PowerShell

—

Yes

Executes the installer assembly class constructor. Upon execution, version information will be displayed the .NET framework install utility.

Input arguments

Name	Type	Default	Description
assembly_dir	path	$Env:TEMP\	directory to drop the compiled installer assembly
test_harness	path	PathToAtomicsFolder\T1218.004\src\InstallUtilTestHarness.ps1	location of the test harness script - Invoke-BuildAndInvokeInstallUtilAssembly
assembly_filename	string	T1218.004.dll	filename of the compiled installer assembly
invocation_method	string	Executable	the type of InstallUtil invocation variant - Executable, InstallHelper, or CheckIfInstallable

Attack command

# Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly
. "#{test_harness}"

$InstallerAssemblyDir = "#{assembly_dir}"
$InstallerAssemblyFileName = "#{assembly_filename}"
$InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName

$CommandLine = "/logfile= /logtoconsole=false `"$InstallerAssemblyFullPath`""
$ExpectedOutput = 'Constructor_'

$TestArgs = @{
    OutputAssemblyDirectory = $InstallerAssemblyDir
    OutputAssemblyFileName = $InstallerAssemblyFileName
    InvocationMethod = '#{invocation_method}'
    CommandLine = $CommandLine
}

$ActualOutput = Invoke-BuildAndInvokeInstallUtilAssembly @TestArgs -MinimumViableAssembly

if ($ActualOutput -ne $ExpectedOutput) {
    throw @"
InstallUtil class constructor execution test failure. Installer assembly execution output did not match the expected output.
Expected: $ExpectedOutput
Actual: $ActualOutput
"@
}

Cleanup command

$InstallerAssemblyDir = "#{assembly_dir}"
$InstallerAssemblyFileName = "#{assembly_filename}"
$InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName
Remove-Item -Path $InstallerAssemblyFullPath -ErrorAction Ignore

Prerequisite

InstallUtil test harness script must be installed at specified location (#{test_harness})

Check

if (Test-Path "#{test_harness}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{test_harness}") -ErrorAction ignore | Out-Null
Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.004/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}"

GUID8e0add3a-ba2f-4c01-8e6d-349da7b3939d

InstallUtil Install method call

windows

PowerShell

—

Yes

Executes the Install Method. Upon execution, version information will be displayed the .NET framework install utility.

Input arguments

Name	Type	Default	Description
assembly_dir	path	$Env:TEMP\	directory to drop the compiled installer assembly
test_harness	path	PathToAtomicsFolder\T1218.004\src\InstallUtilTestHarness.ps1	location of the test harness script - Invoke-BuildAndInvokeInstallUtilAssembly
assembly_filename	string	T1218.004.dll	filename of the compiled installer assembly
invocation_method	string	Executable	the type of InstallUtil invocation variant - Executable, InstallHelper, or CheckIfInstallable

Attack command

# Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly
. "#{test_harness}"

$InstallerAssemblyDir = "#{assembly_dir}"
$InstallerAssemblyFileName = "#{assembly_filename}"
$InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName

$CommandLine = "/logfile= /logtoconsole=false /installtype=notransaction /action=install `"$InstallerAssemblyFullPath`""
$ExpectedOutput = 'Constructor_Install_'

$TestArgs = @{
    OutputAssemblyDirectory = $InstallerAssemblyDir
    OutputAssemblyFileName = $InstallerAssemblyFileName
    InvocationMethod = '#{invocation_method}'
    CommandLine = $CommandLine
}

$ActualOutput = Invoke-BuildAndInvokeInstallUtilAssembly @TestArgs

if ($ActualOutput -ne $ExpectedOutput) {
    throw @"
InstallUtil Install method execution test failure. Installer assembly execution output did not match the expected output.
Expected: $ExpectedOutput
Actual: $ActualOutput
"@
}

Cleanup command

$InstallerAssemblyDir = "#{assembly_dir}"
$InstallerAssemblyFileName = "#{assembly_filename}"
$InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName
Remove-Item -Path $InstallerAssemblyFullPath -ErrorAction Ignore

Prerequisite

InstallUtil test harness script must be installed at specified location (#{test_harness})

Check

if (Test-Path "#{test_harness}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{test_harness}") -ErrorAction ignore | Out-Null
Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.004/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}"

GUIDdebb9f2e-0a22-4951-9c23-97c94df25871

InstallUtil Uninstall method call - /U variant

windows

PowerShell

—

Yes

Executes the Uninstall Method. Upon execution, version information will be displayed the .NET framework install utility.

Input arguments

Name	Type	Default	Description
assembly_dir	path	$Env:TEMP\	directory to drop the compiled installer assembly
test_harness	path	PathToAtomicsFolder\T1218.004\src\InstallUtilTestHarness.ps1	location of the test harness script - Invoke-BuildAndInvokeInstallUtilAssembly
assembly_filename	string	T1218.004.dll	filename of the compiled installer assembly
invocation_method	string	Executable	the type of InstallUtil invocation variant - Executable, InstallHelper, or CheckIfInstallable

Attack command

# Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly
. "#{test_harness}"

$InstallerAssemblyDir = "#{assembly_dir}"
$InstallerAssemblyFileName = "#{assembly_filename}"
$InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName

$CommandLine = "/logfile= /logtoconsole=false /U `"$InstallerAssemblyFullPath`""
$ExpectedOutput = 'Constructor_Uninstall_'

$TestArgs = @{
    OutputAssemblyDirectory = $InstallerAssemblyDir
    OutputAssemblyFileName = $InstallerAssemblyFileName
    InvocationMethod = '#{invocation_method}'
    CommandLine = $CommandLine
}

$ActualOutput = Invoke-BuildAndInvokeInstallUtilAssembly @TestArgs

if ($ActualOutput -ne $ExpectedOutput) {
    throw @"
InstallUtil Uninstall method execution test failure. Installer assembly execution output did not match the expected output.
Expected: $ExpectedOutput
Actual: $ActualOutput
"@
}

Cleanup command

$InstallerAssemblyDir = "#{assembly_dir}"
$InstallerAssemblyFileName = "#{assembly_filename}"
$InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName
Remove-Item -Path $InstallerAssemblyFullPath -ErrorAction Ignore

Prerequisite

InstallUtil test harness script must be installed at specified location (#{test_harness})

Check

if (Test-Path "#{test_harness}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{test_harness}") -ErrorAction ignore | Out-Null
Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.004/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}"

GUID4eec4259-fe2a-4aab-b36b-62f1b2b1c483

InstallUtil Uninstall method call - '/installtype=notransaction /action=uninstall' variant

windows

PowerShell

—

Yes

Executes the Uninstall Method. Upon execution, version information will be displayed the .NET framework install utility.

Input arguments

Name	Type	Default	Description
assembly_dir	path	$Env:TEMP\	directory to drop the compiled installer assembly
test_harness	path	PathToAtomicsFolder\T1218.004\src\InstallUtilTestHarness.ps1	location of the test harness script - Invoke-BuildAndInvokeInstallUtilAssembly
assembly_filename	string	T1218.004.dll	filename of the compiled installer assembly
invocation_method	string	Executable	the type of InstallUtil invocation variant - Executable, InstallHelper, or CheckIfInstallable

Attack command

# Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly
. "#{test_harness}"

$InstallerAssemblyDir = "#{assembly_dir}"
$InstallerAssemblyFileName = "#{assembly_filename}"
$InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName

$CommandLine = "/logfile= /logtoconsole=false /installtype=notransaction /action=uninstall `"$InstallerAssemblyFullPath`""
$ExpectedOutput = 'Constructor_Uninstall_'

$TestArgs = @{
    OutputAssemblyDirectory = $InstallerAssemblyDir
    OutputAssemblyFileName = $InstallerAssemblyFileName
    InvocationMethod = '#{invocation_method}'
    CommandLine = $CommandLine
}

$ActualOutput = Invoke-BuildAndInvokeInstallUtilAssembly @TestArgs

if ($ActualOutput -ne $ExpectedOutput) {
    throw @"
InstallUtil Uninstall method execution test failure. Installer assembly execution output did not match the expected output.
Expected: $ExpectedOutput
Actual: $ActualOutput
"@
}

Cleanup command

$InstallerAssemblyDir = "#{assembly_dir}"
$InstallerAssemblyFileName = "#{assembly_filename}"
$InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName
Remove-Item -Path $InstallerAssemblyFullPath -ErrorAction Ignore

Prerequisite

InstallUtil test harness script must be installed at specified location (#{test_harness})

Check

if (Test-Path "#{test_harness}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{test_harness}") -ErrorAction ignore | Out-Null
Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.004/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}"

GUID3bb26c5c-4280-4479-a5d0-1b572f661bea

InstallUtil HelpText method call

windows

PowerShell

—

Yes

Executes the Uninstall Method. Upon execution, help information will be displayed for InstallUtil.

Input arguments

Name	Type	Default	Description
assembly_dir	path	$Env:TEMP\	directory to drop the compiled installer assembly
test_harness	path	PathToAtomicsFolder\T1218.004\src\InstallUtilTestHarness.ps1	location of the test harness script - Invoke-BuildAndInvokeInstallUtilAssembly
assembly_filename	string	T1218.004.dll	filename of the compiled installer assembly
invocation_method	string	Executable	the type of InstallUtil invocation variant - Executable, InstallHelper, or CheckIfInstallable

Attack command

# Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly
. "#{test_harness}"

$InstallerAssemblyDir = "#{assembly_dir}"
$InstallerAssemblyFileName = "#{assembly_filename}"
$InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName

$CommandLine = "/? `"$InstallerAssemblyFullPath`""
$ExpectedOutput = 'Constructor_HelpText_'

$TestArgs = @{
    OutputAssemblyDirectory = $InstallerAssemblyDir
    OutputAssemblyFileName = $InstallerAssemblyFileName
    InvocationMethod = '#{invocation_method}'
    CommandLine = $CommandLine
}

$ActualOutput = Invoke-BuildAndInvokeInstallUtilAssembly @TestArgs

if ($ActualOutput -ne $ExpectedOutput) {
    throw @"
InstallUtil HelpText property execution test failure. Installer assembly execution output did not match the expected output.
Expected: $ExpectedOutput
Actual: $ActualOutput
"@
}

Cleanup command

$InstallerAssemblyDir = "#{assembly_dir}"
$InstallerAssemblyFileName = "#{assembly_filename}"
$InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName
Remove-Item -Path $InstallerAssemblyFullPath -ErrorAction Ignore

Prerequisite

InstallUtil test harness script must be installed at specified location (#{test_harness})

Check

if (Test-Path "#{test_harness}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{test_harness}") -ErrorAction ignore | Out-Null
Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.004/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}"

GUID15d172cb-435e-45d9-a604-6c9fdfefc203

InstallUtil evasive invocation

windows

PowerShell

—

Yes

Executes an InstallUtil assembly by renaming InstallUtil.exe and using a nonstandard extension for the assembly. Upon execution, "Running a transacted installation." will be displayed, along with other information about the opperation. "The transacted install has completed." will be displayed upon completion.

Input arguments

Name	Type	Default	Description
test_harness	path	PathToAtomicsFolder\T1218.004\src\InstallUtilTestHarness.ps1	location of the test harness script - Invoke-BuildAndInvokeInstallUtilAssembly

Attack command

# Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly
. "#{test_harness}"

$InstallerAssemblyDir = "$Env:windir\System32\Tasks"
$InstallerAssemblyFileName = 'readme.txt'
$InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName

$CommandLine = "readme.txt"
$ExpectedOutput = 'Constructor_'

# Explicitly set the directory so that a relative path to readme.txt can be supplied.
Set-Location "$Env:windir\System32\Tasks"

Copy-Item -Path "$([System.Runtime.InteropServices.RuntimeEnvironment]::GetRuntimeDirectory())InstallUtil.exe" -Destination "$Env:windir\System32\Tasks\notepad.exe"

$TestArgs = @{
    OutputAssemblyDirectory = $InstallerAssemblyDir
    OutputAssemblyFileName = $InstallerAssemblyFileName
    InvocationMethod = 'Executable'
    CommandLine = $CommandLine
    InstallUtilPath = "$Env:windir\System32\Tasks\notepad.exe"
}

$ActualOutput = Invoke-BuildAndInvokeInstallUtilAssembly @TestArgs -MinimumViableAssembly

if ($ActualOutput -ne $ExpectedOutput) {
    throw @"
Evasive Installutil invocation test failure. Installer assembly execution output did not match the expected output.
Expected: $ExpectedOutput
Actual: $ActualOutput
"@
}

Cleanup command

Remove-Item -Path "$Env:windir\System32\Tasks\readme.txt" -ErrorAction Ignore
Remove-Item -Path "$Env:windir\System32\Tasks\readme.InstallLog" -ErrorAction Ignore
Remove-Item -Path "$Env:windir\System32\Tasks\readme.InstallState" -ErrorAction Ignore
Remove-Item -Path "$Env:windir\System32\Tasks\notepad.exe" -ErrorAction Ignore

Prerequisite

InstallUtil test harness script must be installed at specified location (#{test_harness})

Check

if (Test-Path "#{test_harness}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{test_harness}") -ErrorAction ignore | Out-Null
Invoke-WebRequest 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.004/src/InstallUtilTestHarness.ps1' -OutFile "#{test_harness}"

GUID93f06d96-8a73-4dc4-841a-179283106eff

Tests from Atomic Red Team (MIT licence) · technique definition

InstallUtil detections T1218.004

6 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

67th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs