Skip to content
Threat Feed
Subscribe

Product

Windows Installer

3 briefs RSS
high advisory

Understanding ClickOnce Technology Abuse: Part 1

Threat actors are abusing Microsoft's ClickOnce deployment technology to spread malware, allowing malicious applications to be deployed easily with minimal user interaction and without requiring administrative privileges, ultimately delivering malicious payloads onto user endpoints.

ClickOnce technology +4 clickonce malware-delivery windows endpoint
2t updated
low advisory

Potential Remote File Execution via MSIEXEC

The rule detects the execution of the built-in Windows Installer, msiexec.exe, to install a remote package potentially abused by adversaries for initial access and defense evasion.

Windows Installer msiexec remote-file-execution initial-access defense-evasion windows
2r 3t
medium advisory

MsiExec Child Process Spawning Network Connections for Defense Evasion

Detection of MsiExec spawning child processes that initiate network connections, potentially indicating abuse of Windows Installers for malware delivery and defense evasion.

Elastic Defend +3 defense-evasion windows msiexec
2r 1t