Potential MsiExec Masquerading
Detects the execution of msiexec.exe from an uncommon directory
Detection logic
selection
- Image|endswith: \msiexec.exe
- OriginalFileName: \msiexec.exefilter
Image|startswith:
- C:\Windows\System32\
- C:\Windows\SysWOW64\
- C:\Windows\WinSxS\Condition
selection and not filterRaw YAML
title: Potential MsiExec Masquerading
id: e22a6eb2-f8a5-44b5-8b44-a2dbd47b1144
status: test
description: Detects the execution of msiexec.exe from an uncommon directory
references:
- https://twitter.com/200_okay_/status/1194765831911215104
author: Florian Roth (Nextron Systems)
date: 2019-11-14
modified: 2023-02-21
tags:
- attack.stealth
- attack.t1036.005
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith: '\msiexec.exe'
- OriginalFileName: '\msiexec.exe'
filter:
Image|startswith:
- 'C:\Windows\System32\'
- 'C:\Windows\SysWOW64\'
- 'C:\Windows\WinSxS\'
condition: selection and not filter
falsepositives:
- Unknown
level: highFalse positives
- Unknown