All Detections

File Download Via InstallUtil.EXE

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 2025010

Detects use of .NET InstallUtil.exe in order to download arbitrary files. The files will be written to "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\"

Sigma