Skip to content
Threat Feed
Subscribe
high advisory

Potential MsiExec Masquerading

Detection of msiexec.exe execution from unauthorized directories, a technique used by adversaries to masquerade as legitimate Windows Installer processes.

Triage facts

Revision 1
Applicability
Windows
Evidence
Unknown
Severity
High
Action
Elevated
Sources
2 public sources
Freshness
Revision 1Nov 10, 06:43 UTC
Detection
1 rule
Source quality
A1Likely

Adversaries often attempt to masquerade malicious executables as legitimate Windows system binaries. One such technique involves executing a file named 'msiexec.exe' from a directory other than the standard Windows system folders. This practice attempts to evade detection by hiding within the expected activity of the Windows Installer service.

Recommendation

  • Deploy the Sigma rule provided in this brief to your SIEM to monitor for 'msiexec.exe' processes originating from non-standard file paths.
  • Review and baseline existing legitimate software installation processes that may use custom installers or unconventional deployment paths to avoid false positives.
  • Ensure Sysmon Event ID 1 (Process Creation) is enabled, specifically capturing the 'Image' and 'OriginalFileName' fields.

Immediate actions

Deploy Sigma rule to production SIEM

Detection Engineering 48h

Threat Hunt

Search for all instances of msiexec.exe not located in C:\Windows\System32, C:\Windows\SysWOW64, or C:\Windows\WinSxS

T1036.005 medium high confidence hunt now

Data: Process execution telemetry including full path

Mitigations

Apply execution policies or AppLocker/WDAC rules to restrict non-authorized executable paths

medium IT Operations

Masquerading techniques

Detection coverage 1

Detect Potential MsiExec Masquerading

high

Detects the execution of msiexec.exe from directories outside of standard Windows system paths.

sigma tactics: stealth techniques: T1036.005 sources: process_creation, windows

Detection queries are available on the platform. Get full rules →