Query: detect Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer C in logs
Matching passage: Sigma rule: Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer C. Logsource: windows / process_creation. Rule: title: Obfuscated PowerShell MSI Install via WindowsInstaller COM id: 7b6a7418-3afc-11f0-aff4-000d3abf478c status: experimental description: 'Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`). The technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., ''indowsInstaller.Installer''.Insert(0,''W'')) and correcting malformed URLs (e.g., converting ''htps://'' to ''https://'') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection by hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of `InstallProduct` and COM object creation, particularly combined with hidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction. ' references: - https://informationsecuritybuzz.com/the-real-danger-behind-a-simple-windows-shortcut/ - https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/ - https://www.virustotal.com/gui/file/f9710b0ba4de5fa0e7ec27da462d4d2fc6838eba83a19f23f6617a466bbad457 author: Meroujan Antonyan (vx3r) date: 2025-05-27 tags: - attack.stealth - attack.t1027.010 - attack.t1218.007 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell_ISE.EXE - PowerShell.EXE - pwsh.dll selection_cli: CommandLine|contains|all: - -ComObject - InstallProduct( - .Insert( - UILevel condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects certain command line parameters often used during reconnaissance activity via web shells. Logsource: windows / process_creation. Rule: title: Webshell Detection With Command Line Keywords id: bed2a484-9348-4143-8a8a-b801c979301c status: test description: Detects certain command line parameters often used during reconnaissance activity via web shells references: - https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-ii.html - https://unit42.paloaltonetworks.com/bumblebee-webshell-xhunt-campaign/ - https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson date: 2017-01-01 modified: 2026-07-14 tags: - attack.persistence - attack.discovery - attack.t1505.003 - attack.t1018 - attack.t1033 - attack.t1087 logsource: category: process_creation product: windows detection: selection_webserver_image: ParentImage|endswith: - \w3wp.exe - \php-cgi.exe - \nginx.exe - \httpd.exe - \caddy.exe - \ws_tomcatservice.exe selection_webserver_characteristics_tomcat1: ParentImage|endswith: - \java.exe - \javaw.exe ParentImage|contains: - -tomcat- - \tomcat selection_webserver_characteristics_tomcat2: ParentImage|endswith: - \java.exe - \javaw.exe CommandLine|contains: - catalina.jar - CATALINA_HOME selection_susp_net_utility: OriginalFileName: - net.exe - net1.exe CommandLine|contains: - ' user ' - ' use ' - ' group ' selection_susp_ping_utility: OriginalFileName: ping.exe CommandLine|contains: ' -n ' selection_susp_change_dir: CommandLine|contains: - '&cd&echo' - 'cd /d ' selection_susp_wmic_utility: OriginalFileName: wmic.exe CommandLine|contains: ' /node:' selection_susp_powershell_cli: Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe CommandLine|contains: - ' -enc ' - ' -EncodedCommand ' - ' -w hidden ' - ' -windowstyle hidden' - .WebClient).Download selection_susp_misc_discovery_binaries: - Image|endswith: - \dsquery.exe - \find.exe - \findstr.exe - \ipconfig.exe - \netstat.exe - \nslookup.exe - \pathping.exe - \quser.exe - \schtasks.exe - \systeminfo.exe - \tasklist.exe - \tracert.exe - \wevtutil.exe - \whoami.exe - OriginalFileName: - dsquery.exe - find.exe - findstr.exe - ipconfig.exe - netstat.exe - nslookup.exe - pathping.exe - quser.exe - schtasks.exe - sysinfo.exe - tasklist.exe - tracert.exe - VSSADMIN.EXE - wevtutil.exe - whoami.exe selection_susp_misc_discovery_commands: CommandLine|contains: - ' Test-NetConnection ' - dir \ condition: 1 of selection_webserver_* and 1 of selectio