Skip to content
Threat Feed
Subscribe
medium advisory

Detection of MSI Installation via PowerShell WMI Win32_Product

This brief documents a detection method for the use of PowerShell to trigger MSI installations through the WMI Win32_Product class, a technique often utilized for software deployment or unauthorized persistence.

The Win32_Product WMI class in Windows is designed to query installed MSI packages. However, it also exposes a method that allows for the remote or local installation of new MSI files. Adversaries leverage this functionality to execute malicious MSI files as an alternative to standard installation binaries. By invoking this method via PowerShell's Invoke-CimMethod cmdlet, attackers can maintain stealth by avoiding common process-creation logs associated with msiexec.exe execution directly via the command line. Defenders should monitor Script Block Logging to capture the specific WMI method calls that instantiate the installation process.

Impact

Successful abuse of this technique can lead to silent installation of malicious software, persistence via backdoors disguised as legitimate applications, and potential system compromise. If used for lateral movement, this technique allows an adversary to install software across multiple remote endpoints if they possess appropriate WMI credentials.

Recommendation

Deploy the following Sigma rule to monitor for suspicious MSI installation commands via WMI. Ensure PowerShell Script Block Logging (Event ID 4104) is enabled and forwarded to the SIEM.

  • Enable PowerShell Script Block Logging via Group Policy (Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell > Turn on PowerShell Script Block Logging).
  • Review all detected instances to identify unauthorized software installations or potential persistence mechanisms.

Immediate actions

Enable PowerShell Script Block Logging (Event ID 4104)

IT Operations 72h

Threat Hunt

Search for instances of Invoke-CimMethod targeting Win32_Product

T1218.007 medium high confidence convert to detection

Data: PowerShell Script Block logs (Event ID 4104)

Mitigations

Enforce strict Application Control or AppLocker policies to prevent execution of unauthorized MSIs

medium_term IT Operations

Technique T1218.007

Detection coverage 1

Detect PowerShell WMI Win32_Product MSI Installation

medium

Detects the execution of an MSI file using PowerShell and the WMI Win32_Product class method

sigma tactics: stealth techniques: T1218.007 sources: process_creation, windows

Detection queries are available on the platform. Get full rules →