detect-malicious-use-of-msiexec-mimikatz

id: dc75c3e4-ed46-4183-b1c1-c075c2a4a6d5
name: detect-malicious-use-of-msiexec-mimikatz
description: |
  This query was originally published in the threat analytics report, Msiexec abuse.
  Msiexec.exe is a Windows component that installs files with the .msi extension. These kinds of files are Windows installer packages, and are used by a wide array of legitimate software. However, malicious actors can re-purpose msiexec.exe for living-off-the-land attacks, where they use legitimate system binaries on the compromised device to perform attacks.
  The following query detects activity associated with misuse of msiexec.exe, particularly alongside mimikatz, a common credential dumper and privilege escalation tool.
  Reference - https://www.varonis.com/blog/what-is-mimikatz/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Execution
- Privilege escalation
- Credential Access
query: |
  DeviceProcessEvents
  | where Timestamp > ago(7d)
  | where InitiatingProcessFileName =~ "msiexec.exe"
  //Mimikatz commands
  and (ProcessCommandLine contains "privilege::" 
  or ProcessCommandLine has "sekurlsa" 
  or ProcessCommandLine contains "token::")