Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. It can also be used to bypass process whitelisting through use of attributes within the binary that execute the class decorated with the attribute.

How can I use process monitoring to monitor the execuiton and arguments of InstallUtil.exe within my organization?

For example by using splunk or creating a GPO in Active Directory perhaps?

Reference: https://docs.microsoft.com/en-us/dotnet/framework/tools/installutil-exe-installer-tool

1 Answer 1


IIRC, normal Windows events logs don't have enough detail for your use case. You should run sysmon on your Windows systems and log the output in Splunk. That should give you the information you need to detect undesirable executions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.