T1218.004 | LoFP

T1218.004

Title	Tags
false positives may be present and filtering may be required. certain utilities will run from non-standard paths based on the third-party application in use.	t1036 t1036.003 t1218 T1218.004 endpoint splunk
limited false positives should be present as installutil is not typically used to download remote files. filter as needed based on developers requirements.	t1218 T1218.004 endpoint splunk
limited false positives should be present. filter as needed by parent process or application.	t1218 T1218.004 endpoint splunk
typically, this will not trigger because, by its very nature, installutil does not require credentials. filter as needed.	t1218 T1218.004 endpoint splunk