Windows InstallUtil Execution Suspiciously Omitting /logfile Output
Alert when InstallUtil.exe runs from .NET Framework with logging parameters indicating output suppression.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-01-23
- Updated
- 2026-07-31
What it detects
This rule flags process creation events where InstallUtil.exe is launched from the Microsoft .NET Framework directory while the command line contains indicators of missing or non-recorded logging. Attackers can use InstallUtil to execute payloads through a trusted binary while reducing visibility. The detection relies on Windows process creation telemetry and specific Image and CommandLine substrings/flags that match the suspicious logging configuration.
Reporting behind it
- securelist.comhttps://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/
- learn.microsoft.comhttps://learn.microsoft.com/en-us/dotnet/framework/tools/installutil-exe-installer-tool
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_instalutil_no_log_execution.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-installutil-exe-execution-missing-logfile-parameter-d042284c
title: Windows InstallUtil Execution Suspiciously Omitting /logfile Output
id: 0cf97d90-612b-42d8-95b6-967a5e8bf0a9
status: test
description: This rule flags process creation events where InstallUtil.exe is launched from the Microsoft .NET Framework directory while the command line contains indicators of missing or non-recorded logging. Attackers can use InstallUtil to execute payloads through a trusted binary while reducing visibility. The detection relies on Windows process creation telemetry and specific Image and CommandLine substrings/flags that match the suspicious logging configuration.
references:
- https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/
- https://learn.microsoft.com/en-us/dotnet/framework/tools/installutil-exe-installer-tool
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_instalutil_no_log_execution.yml
author: frack113, Huntrule Team
date: 2022-01-23
modified: 2022-02-04
tags:
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \InstallUtil.exe
Image|contains: Microsoft.NET\Framework
CommandLine|contains|all:
- "/logfile= "
- /LogToConsole=false
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: d042284c-a296-4988-9be5-f424fadcc28c
type: derived