Cross-source coverage
T1218.007 / ATT&CK
System Binary Proxy Execution: Msiexec
50 rules across 5 sources.
Showing deprecated rules · back to the default
From MITRE ATT&CK 19.2
Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi). The Msiexec.exe binary may also be digitally signed by Microsoft.
Adversaries may abuse msiexec.exe to launch local or network accessible MSI files. Msiexec.exe can also execute DLLs. Since it may be signed and native on Windows systems, msiexec.exe can be used to bypass application control solutions that do not account for its potential abuse. Msiexec.exe execution may also be elevated to SYSTEM privileges if the AlwaysInstallElevated policy is enabled.
- Tactics
- Stealth
- Platforms
- Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:Sysmon
How MITRE says to detect it DET0158
Detection of Msiexec Abuse for Local, Network, and DLL Execution
Windows Analytic 0445
Detection of msiexec.exe execution where command-line arguments reference remote MSI packages, UNC paths, HTTP/HTTPS URLs, or DLLs, correlated with subsequent module loads and/or network connections to previously unseen destinations. The behavioral chain links process creation of msiexec.exe with suspicious parameters, network activity to retrieve payloads, and module loading indicative of malicious installation or DLL execution.
WinEventLog:SecurityEventCode=4688WinEventLog:SysmonEventCode=7WinEventLog:SysmonEventCode=3, 22
elastic/protections-artifacts
18 rules| Detection | Severity | Format |
|---|---|---|
| DLL Dropped by MSIEXEC followed by SideLoad | Undefined | Elastic TOML |
| Encoded Powershell Execution via MsiExec | Undefined | Elastic TOML |
| Execution via MsiExec DownloadAndExecute CustomAction | Undefined | Elastic TOML |
| Execution via Windows Installer Transforms | Undefined | Elastic TOML |
| Msiexec Execution via a Windows Script Interpreter | Undefined | Elastic TOML |
| MSI Rollback Script File by Unusual Process | Undefined | Elastic TOML |
| Potential Remote Execution via IMsiServer | Undefined | Elastic TOML |
| Privilege Escalation via Windows Installer Hijack | Undefined | Elastic TOML |
| Remote File Execution via MSIEXEC | Undefined | Elastic TOML |
| Remote MSI Package Installation via MSIEXEC | Undefined | Elastic TOML |
+ 8 more from elastic/protections-artifacts → showing the 10 highest-severity
elastic/detection-rules
12 rules| Detection | Severity | Format |
|---|---|---|
| Potential Escalation via Vulnerable MSI Repair | High | Elastic TOML |
| Potential Remote Install via MsiExec | High | Elastic TOML |
| Suspicious Microsoft HTML Application Child Process | High | Elastic TOML |
| Execution of a Downloaded Windows Script | Medium | Elastic TOML |
| MsiExec Service Child Process With Network Connection | Medium | Elastic TOML |
| Persistence via a Windows Installer | Medium | Elastic TOML |
| Suspicious Execution from a Mounted Device | Medium | Elastic TOML |
| Suspicious Execution from VS Code Extension | Medium | Elastic TOML |
| Suspicious JetBrains TeamCity Child Process | Medium | Elastic TOML |
| Suspicious ScreenConnect Client Child Process | Medium | Elastic TOML |
+ 2 more from elastic/detection-rules → showing the 10 highest-severity
SigmaHQ/sigma
10 rules| Detection | Severity | Format |
|---|---|---|
| Obfuscated PowerShell MSI Install via WindowsInstaller COM | High | Sigma |
| DllUnregisterServer Function Call Via Msiexec.EXE | Medium | Sigma |
| Msiexec Quiet Installation | Medium | Sigma |
| MsiExec Web Install | Medium | Sigma |
| MSI Installation From Web | Medium | Sigma |
| PowerShell WMI Win32_Product Install MSI | Medium | Sigma |
| Suspicious MsiExec Embedding Parent | Medium | Sigma |
| Suspicious Msiexec Execute Arbitrary DLL | Medium | Sigma |
| Suspicious Msiexec Quiet Install From Remote Location | Medium | Sigma |
| Msiexec.EXE Initiated Network Connection Over HTTP | Low | Sigma |
splunk/security_content
9 rules| Detection | Severity | Format |
|---|---|---|
| Uninstall App Using MsiExec | Undefined | SPL |
| Windows HTTP Network Communication From MSIExec | Undefined | SPL |
| Windows MSIExec DLLRegisterServer | Undefined | SPL |
| Windows MsiExec HideWindow Rundll32 Execution | Undefined | SPL |
| Windows MSIExec Remote Download | Undefined | SPL |
| Windows MSIExec Spawn Discovery Command | Undefined | SPL |
| Windows MSIExec Spawn WinDBG | Undefined | SPL |
| Windows MSIExec Unregister DLLRegisterServer | Undefined | SPL |
| Windows MSI Rollback Script Deleted By Non-Msiexec Process | Undefined | SPL |
chronicle/detection-rules
1 rule| Detection | Severity | Format |
|---|---|---|
| msiexec_web_install | Undefined | YARA-L |