Installer-Abuse - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/installer-abuse/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 05 Oct 2026 12:02:44 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDetection of Msiexec.exe Used for Persistencehttps://feed.craftedsignal.io/briefs/2026-10-msiexec-persistence/Mon, 05 Oct 2026 12:02:44 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-msiexec-persistence/This brief identifies the abuse of the Windows Installer process, msiexec.exe, by adversaries to establish persistence via scheduled tasks, startup folders, and registry autorun keys.Adversaries frequently abuse the Windows Installer process (msiexec.exe) as a living-off-the-land technique to maintain persistence on compromised Windows systems. By leveraging the legitimate functionality of msiexec.exe, attackers can mask the creation of malicious scheduled tasks, the placement of payloads in startup directories, or the modification of Windows Registry Run keys. Because msiexec.exe is a trusted system binary, its involvement in these actions often bypasses basic security scrutiny. Defenders should monitor for instances where msiexec.exe performs actions inconsistent with standard software installation patterns, such as creating persistence entries in non-standard locations or modifying registry keys outside of defined enterprise software deployment windows.

Attack Chain

  1. Attacker delivers a malicious MSI package or executes an msiexec.exe command line via a compromised vector.
  2. Msiexec.exe is executed with elevated privileges (often via UAC bypass or service account impersonation).
  3. The installer process proceeds to write a malicious binary or script to a persistence location, such as the Startup folder.
  4. Alternatively, msiexec.exe modifies registry keys under HKLM or HKCU CurrentVersion\Run to trigger execution at next login.
  5. The installer process may create a new Scheduled Task to ensure persistent background execution.
  6. Attacker deletes the original MSI package to clean up artifacts while leaving the persistence mechanism intact.
  7. Upon system reboot or user login, the established persistence entry invokes the malicious payload to regain access.

Impact

Successful exploitation allows an adversary to maintain long-term, persistent access to a compromised host, facilitating further lateral movement, credential theft, or exfiltration. Because this technique uses a native Windows component, it allows for stealthy execution that may evade signature-based detection mechanisms that ignore trusted system binaries.

Recommendation

Prioritize the implementation of EDR telemetry that tracks file and registry modifications specifically sourced from the msiexec.exe process. Enable the provided Sigma rules to capture these modifications. Maintain an allowlist of legitimate installer behaviors, specifically focusing on enterprise-managed deployment software and trusted update processes, to reduce false positives. Investigate any instances where msiexec.exe is spawned by non-standard parent processes, such as web servers, unauthorized PowerShell scripts, or unexpected user-level processes.

]]>mediumadvisorywindowspersistenceliving-off-the-landinstaller-abuse