.NET Process Hollowing InstallUtil case study
This detection identifies activity related to .NET Process Hollowing, specifically focusing on the use of InstallUtil.exe as the target process. It triggers when InstallUtil.exe attempts to access a source image located in a user's AppData or Temp directory, with a file extension of .exe or .bin. This behavior is indicative of a specific threat intelligence report detailing process hollowing techniques involving InstallUtil.exe. A match suggests a strong reason for investigation, as it aligns with published threat reporting, though it does not confirm compromise or success of the activity.
Sigma
