File Download Via InstallUtil.EXE
Detects the use of the .NET utility InstallUtil.exe to download files from remote HTTP or FTP sources. This technique is often used by adversaries to bypass application control and execute malicious code by leveraging a trusted, signed Microsoft binary.
Sigma
