Skip to content
Threat Feed
Subscribe

Product

Windows Installer

4 briefs RSS
medium advisory

Abuse of MSIExec for Remote File Download and Execution

This brief details the abuse of the Windows utility msiexec.exe by attackers to download and execute remote files via HTTP or HTTPS URLs, often leading to unauthorized code execution, system compromise, or further malware deployment.

Windows Installer windows living-off-the-land proxy-execution defense-evasion
2t updated
high advisory

Understanding ClickOnce Technology Abuse: Part 1

Threat actors are abusing Microsoft's ClickOnce deployment technology to spread malware, allowing malicious applications to be deployed easily with minimal user interaction and without requiring administrative privileges, ultimately delivering malicious payloads onto user endpoints.

ClickOnce technology +4 clickonce malware-delivery windows endpoint
2t updated
low advisory

Potential Remote File Execution via MSIEXEC

The rule detects the execution of the built-in Windows Installer, msiexec.exe, to install a remote package potentially abused by adversaries for initial access and defense evasion.

Windows Installer msiexec remote-file-execution initial-access defense-evasion windows
2r 3t
medium advisory

MsiExec Child Process Spawning Network Connections for Defense Evasion

Detection of MsiExec spawning child processes that initiate network connections, potentially indicating abuse of Windows Installers for malware delivery and defense evasion.

Elastic Defend +3 defense-evasion windows msiexec
2r 1t