Suspicious Execution of InstallUtil Without Log
This rule detects the suspicious execution of InstallUtil.exe, a legitimate .NET utility, when it is used to execute an image without logging its activity. Adversaries often leverage InstallUtil.exe for defense evasion and bypassing application control by executing malicious code through a trusted, signed Microsoft binary. The specific conditions for detection are the execution of InstallUtil.exe from a Microsoft .NET Framework directory with command-line arguments that disable logging (`/logfile= ` and `/LogToConsole=false`). This behavior is indicative of an attempt to hide malicious activity.
Sigma
