detect-malicious-use-of-msiexec-powershell

id: 1189dc7d-6d2a-4aa9-ad5f-bebed51474d9
name: detect-malicious-use-of-msiexec-powershell
description: |
  This query was originally published in the threat analytics report, Msiexec abuse.
  Msiexec.exe is a Windows component that installs files with the .msi extension. These kinds of files are Windows installer packages, and are used by a wide array of legitimate software. However, malicious actors can re-purpose msiexec.exe for living-off-the-land attacks, where they use legitimate system binaries on the compromised device to perform attacks.
  The following query detects activity associated with misuse of msiexec.exe, particularly alongside mimikatz, a common credential dumper and privilege escalation tool.
  Reference - https://www.varonis.com/blog/what-is-mimikatz/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Execution
- Privilege escalation
- Credential Access
query: |
  DeviceProcessEvents
  | where Timestamp > ago(7d)
  //Looking for PowerShell
  | where FileName =~ "powershell.exe"
  //Looking for %temp% in the command line indicating deployment 
  and ProcessCommandLine contains "%temp%"//Find credential theft attempts using Msiexec to run Mimikatz commands