InstallUtil registers an assembly from a user-writable or remote path

Siemphony@siemphonymediumT1218.004verified in labPlaybook · Unexpected execution

AN0388 asks for InstallUtil.exe run with arguments naming a non-standard or attacker-supplied assembly, and names `AssemblyPathRegex` — "suspicious assemblies, e.g. in temp folders, user profiles" — as the knob that carries the discrimination. This rule implements that on Sysmon EventID 1: the process is InstallUtil.exe and its command line either points at an assembly in a directory an unprivileged user can write to or on a UNC share, or carries the empty-log plus console-suppressed argument pair that the published application control bypass uses. Both directory list and argument pair are authored, populated into MITRE's knob rather than supplied by it. Note the UNC term is written with four backslashes in the YAML because Sigma reads `\\` as one literal backslash — written with two it would degrade to "contains a backslash", which every Windows path satisfies. Two limits: a renamed copy of InstallUtil.exe defeats the filename match, and an assembly dropped into a legitimate application directory before registration matches neither branch, so this rule sees the sloppy staging and not the careful one. The other three sources in the brief are not used — the file-creation leg (EventID 11) and the module-load leg (EventID 7) only become evidence when joined to the execution inside MITRE's `TimeWindow`, which is a cross-event correlation Sigma cannot express, and PowerShell 4103/4104 sees an InstallUtil invocation only when it happened to be typed into PowerShell. Prerequisite: Sysmon is not present in a default install; where this category is fed by Security 4688 instead, both *Audit Process Creation* and the separate *Include command line in process creation events* policy must be enabled and the field names differ — zero rows from an unconfigured feed reads as quiet when it means blind. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0138, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: InstallUtil registers an assembly from a user-writable or remote path2id: ddf4f1ef-da1d-4a4f-8a18-27e9793056073status: experimental4description: |5  AN0388 asks for InstallUtil.exe run with arguments naming a non-standard or6  attacker-supplied assembly, and names `AssemblyPathRegex` — "suspicious7  assemblies, e.g. in temp folders, user profiles" — as the knob that carries8  the discrimination. This rule implements that on Sysmon EventID 1: the process9  is InstallUtil.exe and its command line either points at an assembly in a10  directory an unprivileged user can write to or on a UNC share, or carries the11  empty-log plus console-suppressed argument pair that the published application12  control bypass uses. Both directory list and argument pair are authored,13  populated into MITRE's knob rather than supplied by it. Note the UNC term is14  written with four backslashes in the YAML because Sigma reads `\\` as one15  literal backslash — written with two it would degrade to "contains a16  backslash", which every Windows path satisfies. Two limits: a renamed copy of17  InstallUtil.exe defeats the filename match, and an assembly dropped into a18  legitimate application directory before registration matches neither branch,19  so this rule sees the sloppy staging and not the careful one. The other three20  sources in the brief are not used — the file-creation leg (EventID 11) and the21  module-load leg (EventID 7) only become evidence when joined to the execution22  inside MITRE's `TimeWindow`, which is a cross-event correlation Sigma cannot23  express, and PowerShell 4103/4104 sees an InstallUtil invocation only when it24  happened to be typed into PowerShell. Prerequisite: Sysmon is not present in a25  default install; where this category is fed by Security 4688 instead, both26  *Audit Process Creation* and the separate *Include command line in process27  creation events* policy must be enabled and the field names differ — zero rows28  from an unconfigured feed reads as quiet when it means blind.29  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0138, not hand-written and not tested by its author. Any lab result is on this rule's own page.30references:31  - https://attack.mitre.org/techniques/T1218/00432  - https://attack.mitre.org/detectionstrategies/DET013833author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)34date: 2026-08-1635tags:36  - attack.defense-evasion37  - attack.t1218.00438logsource:39  category: process_creation40  product: windows41detection:42  selection_installutil:43    Image|endswith: '\InstallUtil.exe'44  selection_suspect_path:45    CommandLine|contains:46      - '\AppData\Local\Temp\'47      - '\AppData\Roaming\'48      - '\Windows\Temp\'49      - '\ProgramData\'50      - '\Users\Public\'51      - '\Downloads\'52      - '\PerfLogs\'53      - '\\\\'54  selection_suspect_args:55    CommandLine|contains|all:56      - 'logfile='57      - 'LogToConsole=false'58  condition: selection_installutil and 1 of selection_suspect*59falsepositives:60  - "Product installers and MSI custom actions that register a .NET Windows service. These stage the assembly under `%TEMP%` or `%ProgramData%` and call InstallUtil with `/logfile=` and `/LogToConsole=false` to keep the setup UI clean, which satisfies both branches at once and is the largest benign source here."61  - "Software distribution and configuration management agents that run an install or uninstall step from a cached package directory under `\\ProgramData\\` or from a UNC deployment share, which is exactly the remote-path branch."62  - "Developer and build-agent workstations, where InstallUtil is run by hand or by a post-build step against an assembly sitting in a project folder under the user profile."63  - "Line-of-business application updaters that unpack a new service assembly into `\\AppData\\Local\\Temp\\`, unregister the old one and register the new one on every update cycle."64level: medium

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (FolderPath endswith "\\InstallUtil.exe" and ((ProcessCommandLine contains "\\AppData\\Local\\Temp\\" or ProcessCommandLine contains "\\AppData\\Roaming\\" or ProcessCommandLine contains "\\Windows\\Temp\\" or ProcessCommandLine contains "\\ProgramData\\" or ProcessCommandLine contains "\\Users\\Public\\" or ProcessCommandLine contains "\\Downloads\\" or ProcessCommandLine contains "\\PerfLogs\\" or ProcessCommandLine contains "\\\\") or (ProcessCommandLine contains "logfile=" and ProcessCommandLine contains "LogToConsole=false")))

Splunk · SPL

Run this as a search.

index=* (Image="*\\InstallUtil.exe" AND ((CommandLine="*\\AppData\\Local\\Temp\\*" OR CommandLine="*\\AppData\\Roaming\\*" OR CommandLine="*\\Windows\\Temp\\*" OR CommandLine="*\\ProgramData\\*" OR CommandLine="*\\Users\\Public\\*" OR CommandLine="*\\Downloads\\*" OR CommandLine="*\\PerfLogs\\*" OR CommandLine="*\\\\*") OR (CommandLine="*logfile=*" AND CommandLine="*LogToConsole=false*")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.executable) LIKE "*\\\\installutil.exe" AND ((TO_LOWER(process.command_line) LIKE "*\\\\appdata\\\\local\\\\temp\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\appdata\\\\roaming\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\windows\\\\temp\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\programdata\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\users\\\\public\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\downloads\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\perflogs\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\\\\\*") OR (TO_LOWER(process.command_line) LIKE "*logfile=*" AND TO_LOWER(process.command_line) LIKE "*logtoconsole=false*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\InstallUtil\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)((\\AppData\\Local\\Temp\\|\\AppData\\Roaming\\|\\Windows\\Temp\\|\\ProgramData\\|\\Users\\Public\\|\\Downloads\\|\\PerfLogs\\|\\\\)|(?=.*(?:logfile=))(?=.*(?:LogToConsole=false)).*)</field>    <description>InstallUtil registers an assembly from a user-writable or remote path</description>    <mitre>      <id>T1218.004</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: signed_binary_proxy
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: ddf4f1ef-da1d-4a4f-8a18-27e979305607

ATT&CKT1218.004

T1218.004InstallUtil

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification2 runs

Verified in Siemphony lab

Security Datasets — InstallUtil.exe used to proxy execution (Covenant)
passed
Siemphony IR · 3 Sept 2026
1 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1218.004, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Make the argument pair a corroborator rather than a trigger:
Anchor the UNC term so it requires a quote or space in front of it.
Close the working-directory gap. `cd %TEMP% && InstallUtil.exe /logfile=
Exclude by parent, not by path — allowlist your packaging and deployment

Declared by the author

Product installers and MSI custom actions that register a .NET Windows service. These stage the assembly under %TEMP% or %ProgramData% and call InstallUtil with /logfile= and /LogToConsole=false to keep the setup UI clean, which satisfies both branches at once and is the largest benign source here.
Software distribution and configuration management agents that run an install or uninstall step from a cached package directory under \ProgramData\ or from a UNC deployment share, which is exactly the remote-path branch.
Developer and build-agent workstations, where InstallUtil is run by hand or by a post-build step against an assembly sitting in a project folder under the user profile.
Line-of-business application updaters that unpack a new service assembly into \AppData\Local\Temp\, unregister the old one and register the new one on every update cycle.

Lessonsigned binary proxy

signed binary proxyAI draft — unreviewed

01 · What this rule detects

AN0388 asks for InstallUtil.exe running with arguments that name a non-standard or attacker-supplied assembly. MITRE's AssemblyPathRegex knob carries the discrimination — "suspicious assemblies, e.g. in temp folders, user profiles" — and that description is all MITRE supplies. The rule turns it into a Sysmon EventID 1 match: the process is InstallUtil, and its command line either points somewhere an unprivileged user can write or carries the argument pair from the published application-control bypass.

02 · Telemetry you need

category: process_creation / product: windows, verbatim from AN0388's Sysmon EventID 1 source. Both branches read CommandLine, so where the category is fed by Security 4688 instead, Audit Process Creation alone leaves the rule blind — the separate Include command line in process creation events policy populates that field, and the 4688 field names differ.
The brief's other three sources are unused. EventID 11 (the assembly being written) and EventID 7 (it being loaded) become evidence only when joined to the execution inside MITRE's TimeWindow, a cross-event correlation Sigma cannot express. PowerShell 4103/4104 sees InstallUtil only when it happened to be typed into PowerShell.

03 · How the logic works

Three blocks under selection_installutil and 1 of selection_suspect*. selection_installutil is Image|endswith: '\InstallUtil.exe' — filename-anchored, so it survives both Framework and Framework64 and every version directory beneath them. selection_suspect_path is eight CommandLine|contains terms: the user-writable directories (\AppData\Local\Temp\, \AppData\Roaming\, \Windows\Temp\, \ProgramData\, \Users\Public\, \Downloads\, \PerfLogs\) plus \\\\ for a UNC path. That list is authored and populated into MITRE's knob, not taken from it. The four backslashes are load-bearing: Sigma reads \\ as one literal backslash, so writing two would degrade the term to "contains a backslash" — which every Windows path satisfies, making the branch permanently true. selection_suspect_args is contains|all of logfile= and LogToConsole=false, the pair that suppresses InstallUtil's own output.

04 · Common false positives

The argument pair is the weak branch, and because the condition is 1 of, it alerts on its own. That pair is the LOLBAS write-up's copy-paste form, but it is equally what a vendor installer or MSI custom action uses to keep the setup UI clean — the rule's own first false positive calls it the largest benign source here. Alone, that branch is closer to an installer detector than a bypass detector. level: medium holds because InstallUtil runs are rare overall, not because the branch discriminates.
The UNC term is loose in a second way: it matches a doubled backslash anywhere, so a build script concatenating a directory and a filename into C:\Program Files\App\\Service.exe fires the remote-path branch with nothing remote about it.
Behind those: software distribution agents installing from cached package directories or deployment shares, developer and build-agent workstations, and line-of-business updaters that unpack a service assembly into %TEMP% on every update cycle.

05 · Detection maturity

tier_1: . Machine-derived from a scaffold containing no query logic and never executed against a log line. Everything above is reasoning about YAML, including the claim about which branch is loudest.
tier_2: run it read-only, split hits by branch, and count how many `logfile=` / `LogToConsole=false` matches came from a signed installer. If that is most of them — the expected result — restructure the condition before the rule ever raises an alert.
tier_3: ** join the execution to the EventID 11 write of the assembly inside MITRE's TimeWindow, so an alert means a freshly staged binary rather than a bare invocation.

Related detections4 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/ddf4f1ef-da1d-4a4f-8a18-27e979305607

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

InstallUtil registers an assembly from a user-writable or remote path

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it