name: Windows InstallUtil Uninstall Option
id: cfa7b9ac-43f0-11ec-9b48-acde48001122
version: 1
date: '2021-11-12'
author: Michael Haag, Splunk
status: production
type: TTP
description: 'The following analytic identifies the Windows InstallUtil.exe binary.
  This will execute code while bypassing application control using the `/u` (uninstall)
  switch. 

  InstallUtil uses the functions install and uninstall within the System.Configuration.Install
  namespace to process .net assembly. Install function requires admin privileges,
  however, uninstall function can be run as an unprivileged user.

  When `InstallUtil.exe` is used in a malicous manner, the path to an executable on
  the filesystem is typically specified. Take note of the parent process. In a suspicious
  instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe`
  or `Explorer.exe`. 

  If used by a developer, typically this will be found with multiple command-line
  switches/arguments and spawn from Visual Studio. 

  During triage review resulting network connections, file modifications, and parallel
  processes. Capture any artifacts and review further.'
data_source:
- Sysmon Event ID 1
search:
  selection1:
    OriginalFileName: InstallUtil.exe
  selection2:
    Image|endswith: installutil.exe
  selection3:
    CommandLine:
    - '*/u*'
    - '*uninstall*'
  condition: (selection1 or selection2) and selection3
how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
  endpoint product.
known_false_positives: Limited false positives should be present. Filter as needed
  by parent process or application.
references:
- https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12
- https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/md/Installutil.exe.md
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
tags:
  analytic_story:
  - Signed Binary Proxy Execution InstallUtil
  - Living Off The Land
  asset_type: Endpoint
  confidence: 100
  impact: 80
  message: An instance of $parent_process_name$ spawning $process_name$ was identified
    on endpoint $dest$ by user $user$ performing an uninstall.
  mitre_attack_id:
  - T1218.004
  - T1218
  observable:
  - name: user
    type: User
    role:
    - Victim
  - name: dest
    type: Hostname
    role:
    - Victim
  - name: parent_process_name
    type: Process
    role:
    - Parent Process
  - name: process_name
    type: Process
    role:
    - Child Process
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 80
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: xmlwineventlog