Detectionmediumtest
PowerShell WMI Win32_Product Install MSI
Detects the execution of an MSI file using PowerShell and the WMI Win32_Product class
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
WindowsPowerShell Script
ProductWindows← raw: windows
CategoryPowerShell Script← raw: ps_script
Definition
Requirements: Script Block Logging must be enabled
Detection Logic
Detection Logic1 selector
detection:
selection:
ScriptBlockText|contains|all:
- 'Invoke-CimMethod '
- '-ClassName '
- 'Win32_Product '
- '-MethodName '
- '.msi'
condition: selectionFalse Positives
Unknown
False positive likelihood has not been assessed. Additional context may be needed during triage.
References
MITRE ATT&CK
Tactics
Sub-techniques
Rule Metadata
Rule ID
91109523-17f0-4248-a800-f81d9e7c081d
Status
test
Level
medium
Type
Detection
Created
Sun Apr 24
Author
Path
rules/windows/powershell/powershell_script/posh_ps_win32_product_install_msi.yml
Raw Tags
attack.defense-evasionattack.t1218.007