Windows InstallUtil.exe Execution Missing /logfile Parameter

title: Windows InstallUtil.exe Execution Missing /logfile Parameter
id: 0cf97d90-612b-42d8-95b6-967a5e8bf0a9
status: test
description: This rule flags process creation events where InstallUtil.exe is executed from the Microsoft.NET Framework directory without the expected logfile configuration. Attackers may use InstallUtil.exe to run code while reducing observable output, so missing or altered logging parameters can indicate stealthy execution. The detection relies on Windows process creation telemetry, including the executed image path and command-line arguments.
references:
  - https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/
  - https://learn.microsoft.com/en-us/dotnet/framework/tools/installutil-exe-installer-tool
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_instalutil_no_log_execution.yml
author: frack113, Huntrule Team
date: 2022-01-23
modified: 2022-02-04
tags:
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \InstallUtil.exe
    Image|contains: Microsoft.NET\Framework
    CommandLine|contains|all:
      - "/logfile= "
      - /LogToConsole=false
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: d042284c-a296-4988-9be5-f424fadcc28c
    type: derived