InstallUtil.exe Proxy Execution of Unsigned .NET Assembly - T1218.004

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•2

Detects execution of the Microsoft .NET Framework InstallUtil.exe utility when it is invoked to load a file from suspicious user-writable directories (such as AppData, Temp, Downloads, or Desktop). This activity is indicative of potential proxy execution of malicious code, a technique often used to bypass application whitelisting.