T1218.004 InstallUtil
Subtécnica de T1218 System Binary Proxy Execution
Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a…
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
SigmaHQ no tiene reglas para esta técnica.
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.