Detect InstallUtil execution

Most of the malicious software uses InstallUtil to execute the untrusted files. This sample Expert rule detects when InstallUtil is used to execute .exe or .dll files.

Note

Exploit Prevention is not supported in the ARM architecture.

You can exclude the known and trusted applications in the rule, to allow the regular processes for executing .exe and .dll files.

Important

Make sure to test this Expert rule on a client system before enforcing wider.

Rule {
Process {
    Include DESCRIPTION { -v ".NET Framework installation utility" }
}
Target {
    Match FILE {
        Include OBJECT_NAME { -v "**.EXE**"  }
        Include OBJECT_NAME { -v "**.DLL**"  }

Exclude AggregateMatch {        
        Include OBJECT_NAME { -v "C:\\WINDOWS\\**" }
        Include OBJECT_NAME { -v "C:\\PROGRAM FILES\\MCAFEE\\**" }
        Include OBJECT_NAME { -v "C:\\PROGRAM FILES\\COMMON FILES\\MCAFEE\\**" }
        Include OBJECT_NAME { -v "C:\\PROGRAM FILES (X86)\COMMON FILES\\MCAFEE\\**" }
        }

# Excluding known apps
        Exclude AggregateMatch {        
            Include OBJECT_NAME { -v "**snake1.exe*" }
            Include MD5 { -v 2f3b994e836d731d04ad4cf0f37f10ab }
        }
        Include -access "READ WRITE CREATE EXECUTE"
        }              
    }
}

For more Expert Rules examples, visit the Trellix Github repository.