Query: detection rule: Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer C
Matching passage: Sigma rule: Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer C. Logsource: windows / process_creation. Rule: title: Obfuscated PowerShell MSI Install via WindowsInstaller COM id: 7b6a7418-3afc-11f0-aff4-000d3abf478c status: experimental description: 'Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`). The technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., ''indowsInstaller.Installer''.Insert(0,''W'')) and correcting malformed URLs (e.g., converting ''htps://'' to ''https://'') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection by hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of `InstallProduct` and COM object creation, particularly combined with hidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction. ' references: - https://informationsecuritybuzz.com/the-real-danger-behind-a-simple-windows-shortcut/ - https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/ - https://www.virustotal.com/gui/file/f9710b0ba4de5fa0e7ec27da462d4d2fc6838eba83a19f23f6617a466bbad457 author: Meroujan Antonyan (vx3r) date: 2025-05-27 tags: - attack.stealth - attack.t1027.010 - attack.t1218.007 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell_ISE.EXE - PowerShell.EXE - pwsh.dll selection_cli: CommandLine|contains|all: - -ComObject - InstallProduct( - .Insert( - UILevel condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects an Antivirus alert in a highly relevant file path or with a relevant file name. This event must not be ignored j. Logsource: antivirus. Rule: title: Antivirus - Relevant File Paths Alerts Signature id: c9a88268-0047-4824-ba6e-4d81ce0b907c status: test description: 'Detects an Antivirus alert in a highly relevant file path or with a relevant file name. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place. ' references: - https://www.nextron-systems.com/?s=antivirus author: Florian Roth (Nextron Systems), Arnim Rupp date: 2018-09-09 modified: 2026-06-29 tags: - attack.resource-development - attack.t1588 logsource: category: antivirus detection: selection_path: Filename|contains: - :\PerfLogs\ - :\Temp\ - :\Users\Default\ - :\Users\Public\ - :\Windows\ - /www/ - \inetpub\ - \tsclient\ - apache - nginx - tomcat - weblogic selection_ext: Filename|endswith: - .asax - .ashx - .asmx - .asp - .aspx - .bat - .cfm - .cgi - .chm - .cmd - .dat - .ear - .gif - .hta - .jpeg - .jpg - .jsp - .jspx - .lnk - .msc - .php - .pl - .png - .ps1 - .psm1 - .py - .pyc - .rb - .scf - .sct - .sh - .svg - .txt - .vbe - .vbs - .war - .wll - .wsf - .wsh - .xll - .xml condition: 1 of selection_* falsepositives: - Unlikely level: high