Trusted Design

T1118 - InstallUtil

概要

InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) InstallUtil is located in the .NET directories on a Windows system: C:\Windows\Microsoft.NET\Framework\v\InstallUtil.exe and C:\Windows\Microsoft.NET\Framework64\v\InstallUtil.exe. InstallUtil.exe is digitally signed by Microsoft.

Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil may also be used to bypass process whitelisting through use of attributes within the binary that execute the class decorated with the attribute [System.ComponentModel.RunInstaller(true)]. (Citation: LOLBAS Installutil)

この攻撃手法を利用する脅威アクター

この攻撃手法を利用する脅威アクターは登録されていません。

関連する CVE

• CVE-2014-4114
• CVE-2017-0199
• CVE-2012-0158
• CVE-2014-4113
• CVE-2015-1701
• CVE-2015-0016
• CVE-2015-0057
• CVE-2013-7331
• CVE-2015-2360
• CVE-2008-1436
• CVE-2017-0143

攻撃手法 – 脅威アクター Graph

---

← Technique一覧に戻る ← Tactics一覧に戻る