Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumtest

MsiExec Web Install

Detects suspicious msiexec process starts with web addresses as parameter

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Florian Roth (Nextron Systems)Created Fri Feb 09Updated Fri Jan 07f7b5f842-a6af-4da5-9e95-e32478f3cd2fwindows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic1 selector
detection:
    selection:
        CommandLine|contains|all:
            - ' msiexec'
            - '://'
    condition: selection
False Positives

False positives depend on scripts and administrative tools used in the monitored environment

References
1
Resolving title…
blog.trendmicro.com
MITRE ATT&CK

Sub-techniques

T1218.007 · Msiexec
Related Rules
SimilarDetectionmedium

Suspicious Msiexec Quiet Install From Remote Location

Detects usage of Msiexec.exe to install packages hosted remotely quietly

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata
Rule ID
f7b5f842-a6af-4da5-9e95-e32478f3cd2f
Status
test
Level
medium
Type
Detection
Created
Fri Feb 09
Modified
Fri Jan 07
Author
Florian Roth (Nextron Systems)
Path
rules/windows/process_creation/proc_creation_win_msiexec_web_install.yml
Raw Tags
attack.defense-evasionattack.t1218.007attack.command-and-controlattack.t1105
View on GitHub