MsiExec DllUnregisterServer execution

The Windows Installer utility (msiexec.exe) is a signed, legitimate binary used for installing and configuring software. Attackers can leverage the "/Z" flag to load a specified DLL and call its exported "DllUnregisterServer" function. This technique is often used to bypass security controls or execute malicious code in the context of a trusted process. Because this behavior is atypical for standard administrative tasks outside of specific update or maintenance workflows, it serves as a high-fidelity indicator of potential malicious activity. Defenders should monitor process command lines for the use of the "/Z" parameter in conjunction with external DLL references.

Attack Chain

1. Attacker crafts a malicious DLL file containing a payload within the DllUnregisterServer exported function.
2. The DLL is staged on the target system, typically in a directory where the user or service has write permissions.
3. Attacker identifies the msiexec.exe utility, a native Windows component.
4. Attacker executes msiexec.exe via command line using the "/Z" flag.
5. The command line specifies the full path to the malicious DLL as the argument for the "/Z" parameter.
6. MsiExec initializes and loads the attacker-supplied DLL into its memory space.
7. MsiExec calls the DllUnregisterServer function within the loaded DLL.
8. The payload executes, potentially resulting in secondary malware deployment, C2 communication, or lateral movement.

Impact

Successful exploitation allows for execution of arbitrary code in the context of the msiexec.exe process, potentially bypassing application allowlisting and leveraging the trusted reputation of the Windows Installer binary.

Recommendation

Deploy the provided Sigma rule to detect suspicious msiexec.exe invocations. Audit legitimate software installers or update agents in the environment that may utilize the "/Z" flag and include them in the filter logic of the detection rule.