huntrule

Windows InstallUtil.exe Used to Download Remote Files

Flags InstallUtil.exe execution with http/https/ftp URLs indicative of remote file downloads on Windows.

FreeUnreviewedSigmamediumv1
title: Windows InstallUtil.exe Used to Download Remote Files
id: 0d5f1528-2fcf-4eaa-a598-e515e9542300
status: test
description: This rule identifies process creation where InstallUtil.exe is executed and the command line contains remote URL schemes (http, https, or ftp). Attackers abuse InstallUtil.exe to retrieve arbitrary content and place it on disk, which can support initial access and staging while blending into legitimate tooling. Detection relies on Windows process creation telemetry capturing both the binary name and the command-line arguments.
references:
  - https://github.com/LOLBAS-Project/LOLBAS/pull/239
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_installutil_download.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-19
modified: 2023-11-09
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \InstallUtil.exe
    - OriginalFileName: InstallUtil.exe
  selection_cli:
    CommandLine|contains:
      - ftp://
      - http://
      - https://
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 75edd216-1939-4c73-8d61-7f3a0d85b5cc
    type: derived

What it detects

This rule identifies process creation where InstallUtil.exe is executed and the command line contains remote URL schemes (http, https, or ftp). Attackers abuse InstallUtil.exe to retrieve arbitrary content and place it on disk, which can support initial access and staging while blending into legitimate tooling. Detection relies on Windows process creation telemetry capturing both the binary name and the command-line arguments.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.