Python Script Injection into InstallUtil.exe

Tim Peck@timpeck

•updated Jan 28, 2026•1•1•47

Detects a Python process, potentially renamed, injecting code into the InstallUtil.exe utility. This behavior is a known TTP used by a Vietnamese threat actor in PureRAT campaigns, where a Python loader fetches a payload and injects it into a legitimate .NET utility to execute shellcode and evade defenses.