Microsoft (R).NET Framework Installation utility Version 4.0.30319.17929
Copyright (C) Microsoft Corporation. All rights reserved.
Hello From Uninstall...I carry out the real work...
Enjoy the sweet reverse shell:
Look for InstallUtil processes that have established connections, especially those with cmd or powershell processes running as children - you should treat them as suspicious and investigate the endpoint closer:
A very primitive query in kibana allowing to find events where InstallUtil spawns cmd: