Query: detection rule: Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for
Matching passage: Sigma rule: Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for. Logsource: windows / process_creation. Rule: title: Msiexec Quiet Installation id: 79a87aa6-e4bd-42fc-a5bb-5e6fbdcd62f5 status: test description: 'Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi) ' references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md - https://twitter.com/_st0pp3r_/status/1583914244344799235 author: frack113 date: 2022-01-16 modified: 2026-07-28 tags: - attack.stealth - attack.t1218.007 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \msiexec.exe - OriginalFileName: msiexec.exe selection_cli: CommandLine|contains|windash: - -i - -package - -a - -j selection_quiet: CommandLine|contains|windash: -q filter_main_system_temp: ParentImage|startswith: C:\Windows\Temp\ filter_main_ccm: ParentImage: C:\Windows\CCM\Ccm32BitLauncher.exe IntegrityLevel: - System - S-1-16-16384 filter_optional_user_temp: ParentImage|startswith: C:\Users\ ParentImage|contains: \AppData\Local\Temp\ filter_optional_wsl: ParentImage|endswith: C:\Windows\System32\wsl.exe Image|endswith: C:\Windows\System32\msiexec.exe condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - WindowsApps installing updates via the quiet flag level: medium
Near-miss passage: Sigma rule: Detects Netsh command execution that whitelists a program located in a suspicious location in the Windows Firewall. Logsource: windows / process_creation. Rule: title: Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE id: a35f5a72-f347-4e36-8895-9869b0d5fc6d status: test description: Detects Netsh command execution that whitelists a program located in a suspicious location in the Windows Firewall references: - https://www.virusradar.com/en/Win32_Kasidet.AD/description - https://www.hybrid-analysis.com/sample/07e789f4f2f3259e7559fdccb36e96814c2dbff872a21e1fa03de9ee377d581f?environmentId=100 author: Sander Wiebing, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community date: 2020-05-25 modified: 2023-12-11 tags: - attack.defense-impairment - attack.t1686.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli: - CommandLine|contains|all: - firewall - add - allowedprogram - CommandLine|contains|all: - advfirewall - firewall - add - rule - action=allow - program= selection_paths: CommandLine|contains: - :\$Recycle.bin\ - :\RECYCLER.BIN\ - :\RECYCLERS.BIN\ - :\SystemVolumeInformation\ - :\Temp\ - :\Users\Default\ - :\Users\Desktop\ - :\Users\Public\ - :\Windows\addins\ - :\Windows\cursors\ - :\Windows\debug\ - :\Windows\drivers\ - :\Windows\fonts\ - :\Windows\help\ - :\Windows\system32\tasks\ - :\Windows\Tasks\ - :\Windows\Temp\ - \Downloads\ - \Local Settings\Temporary Internet Files\ - \Temporary Internet Files\Content.Outlook\ - '%Public%\' - '%TEMP%' - '%TMP%' condition: all of selection_* falsepositives: - Unknown level: high