Abuse of MSIExec for Remote File Download and Execution

Attackers are leveraging the legitimate Windows installer utility msiexec.exe to download and execute malicious files from remote HTTP or HTTPS servers. This technique, often categorized under signed binary proxy execution, allows adversaries to bypass certain security controls by abusing a trusted system binary. The detection focuses on identifying msiexec.exe processes that include a URL (either HTTP or HTTPS) in their command line, indicating an attempt to fetch an MSI package from an external source. This activity is significant as it can lead to unauthorized code execution, system compromise, or the deployment of additional malware within a compromised network. While the specific initial access vector is not detailed, this method serves as a crucial step for establishing persistence, lateral movement, or executing payloads post-compromise. This behavior is monitored via Endpoint Detection and Response (EDR) agents capturing process execution logs and command-line arguments.

Attack Chain

1. An attacker gains initial execution on a victim system, often through phishing, exploitation of a vulnerable service, or another initial access vector.
2. The attacker initiates a command-line execution leveraging msiexec.exe, including a URL pointing to a remote malicious MSI package.
3. msiexec.exe establishes an outbound network connection to the attacker-controlled HTTP or HTTPS server specified in the command line.
4. The malicious Windows Installer package (.msi) is downloaded to the victim system by msiexec.exe.
5. msiexec.exe then proceeds to parse and execute the contents of the downloaded MSI package, exploiting its legitimate functionality.
6. This execution often results in the unauthorized execution of arbitrary code, such as installing backdoors, deploying ransomware, or establishing persistence mechanisms.
7. The attacker maintains control over the compromised system, enabling further malicious activities like data exfiltration or lateral movement across the network.
8. The ultimate objective varies but can include data theft, financial gain, or disruption of services.

Impact

Successful exploitation of this technique can lead to severe consequences for an organization. The impact includes unauthorized code execution, which grants attackers a persistent foothold on the compromised system. This can swiftly escalate to full system compromise, allowing adversaries to elevate privileges, deploy additional malware like ransomware or information stealers, and exfiltrate sensitive data. Organizations may face significant financial losses due to operational disruption, data recovery costs, and potential regulatory fines if sensitive information is exposed. While this brief does not specify a victim count or sector, the use of a legitimate binary makes this a versatile technique applicable across various industries.

Recommendation

• Deploy the Sigma rules in this brief to your SIEM and tune for your environment.
• Enable Sysmon Event ID 1 (process creation) logging to activate the rule Detect MSIExec Remote Download Attempt.
• Ensure complete command-line logging is enabled for all process creation events from EDR agents for rules like Detect MSIExec Remote Download Attempt.
• Regularly review outbound network connections initiated by msiexec.exe processes for suspicious remote URLs.