Msiexec Quiet Installation for Proxy Execution

Adversaries are actively abusing msiexec.exe, the command-line utility for the Windows Installer, to proxy the execution of malicious payloads. This technique, classified under T1218.007, allows attackers to execute arbitrary code or install unwanted software on victim systems using a legitimate, signed Microsoft binary. By invoking msiexec.exe with quiet installation flags (e.g., -q or /quiet) and other installation parameters (-i, -package, -a, -j), attackers can bypass application whitelisting solutions and evade detection by blending in with normal system activities. This method enables the silent deployment of malware, persistence mechanisms, or other adversarial tools without user interaction or visible prompts, posing a significant challenge for defenders attempting to distinguish malicious activity from legitimate system operations. This technique is often used as a post-compromise action to establish persistence or deliver additional stages of an attack.

Recommendation

• Deploy the Sigma rule Detect Msiexec Quiet Installation via Proxy Execution to your SIEM to identify suspicious msiexec.exe activity.
• Ensure process creation logging is enabled across your endpoints (e.g., via Sysmon or Windows Event Log) to generate the necessary telemetry for the provided Sigma rule.
• Regularly review msiexec.exe processes originating from unusual parent processes or non-standard temporary directories that are not covered by the rule's legitimate filters.