Suspicious Execution of InstallUtil Without Log (via process_creation)

title: Suspicious Execution of InstallUtil Without Log (via process_creation)
id: 6a84cb10-4eff-5c57-b2ce-4f34b316a1b6
status: stable
description: This rule detects the .NET InstallUtil.exe application to execute image without log
references:
    - https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/
    - https://learn.microsoft.com/en-us/dotnet/framework/tools/installutil-exe-installer-tool
author: Huntrule Team
date: 2026-04-09
tags:
    - attack.stealth
    - attack.defense-evasion
    - attack.t1218.004
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\InstallUtil.exe'
        Image|contains: 'Microsoft.NET\Framework'
        CommandLine|contains|all:
            - '/logfile= '
            - '/LogToConsole=false'
    condition: selection
falsepositives:
    - Unknown
level: medium