Skip to content
Threat Feed

Tag

Msi

1 brief RSS
medium advisory

Remote Management Access Launch After MSI Install

Detects an MSI installer execution followed by the execution of commonly abused Remote Management Software like ScreenConnect, potentially indicating abuse where an attacker triggers an MSI install then connects via a guest link with a known session key.

Microsoft Defender XDR command and control rmm msi windows remote access
2r