Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: <code>C:\Windows\Microsoft.NET\Framework\v<version>\InstallUtil.exe</code> and <code>C:\Windows\Microsoft.NET\Framework64\v<version>\InstallUtil.exe</code>.

InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute <code>[System.ComponentModel.RunInstaller(true)]</code>. (Citation: LOLBAS Installutil)
InstallUtil
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1218/004  external_id: T1218.004     source_name: MSDN InstallUtil  description: Microsoft. (n.d.). Installutil.exe (Installer Tool). Retrieved July 1, 2016.  url: https://msdn.microsoft.com/en-us/library/50614e95.aspx     source_name: LOLBAS Installutil  description: LOLBAS. (n.d.). Installutil.exe. Retrieved July 31, 2019.  url: https://lolbas-project.github.io/lolbas/Binaries/Installutil/     