T1218.007 Msiexec
Sub-technique of T1218 System Binary Proxy Execution
Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).(Citation: Microsoft msiexec) The Msiexec.exe binary may also be digitally signed by Microsoft. Adversaries may abuse msiexec.exe to launch local or network accessible MSI files.…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Obfuscated PowerShell MSI Install via WindowsInstaller COMhighexperimental · windows
- DllUnregisterServer Function Call Via Msiexec.EXEmediumtest · windows
- MSI Installation From Webmediumtest · windows
- MsiExec Web Installmediumtest · windows
- Msiexec Quiet Installationmediumtest · windows
- PowerShell WMI Win32_Product Install MSImediumtest · windows
- Suspicious MsiExec Embedding Parentmediumtest · windows
- Suspicious Msiexec Execute Arbitrary DLLmediumtest · windows
- Suspicious Msiexec Quiet Install From Remote Locationmediumtest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.