installutil.exe

installutil.exe installs and uninstalls server resources by running the installer classes inside a .NET assembly. The relevant detail for triage is that it invokes code in the target assembly, specifically methods marked for install or, in the abuse case, an [Obsolete]-style uninstall path, so pointing it at an assembly runs that assembly's code. It ships with the .NET Framework, so the genuine binary lives under C:\Windows\Microsoft.NET\Framework and Framework64, not System32.

Legitimately, installutil is run by administrators and setup programs against real, installed components. The assembly it is pointed at and where that assembly lives are what give an instance meaning.

installutil.exe is a system-binary proxy (T1218.004). Because it runs the installer (and uninstaller) code inside a .NET assembly, an attacker crafts an assembly whose payload lives in that code and runs installutil /u evil.dll (or the install path) to have the signed Microsoft tool execute it. This bypasses application-control rules that trust Microsoft binaries and keeps the payload in a DLL rather than a flagged executable.

Both the binary and the operation are legitimate, so the context is what matters: the assembly path, the parent, and whether the host has any reason to be installing components. An assembly loaded from a temp or download folder, or installutil launched by an Office process, points to abuse.