Msiexec — CraftedSignal Threat Feed

Potential Remote File Execution via MSIEXEC

hello@craftedsignal.io — Mon, 04 May 2026 14:17:05 +0000

The Windows Installer (msiexec.exe) is a built-in Windows component used for installing, modifying, and removing software. Adversaries may abuse msiexec.exe to launch local or network accessible MSI files, bypassing security controls and potentially leading to initial access or defense evasion. This activity is often part of a broader attack chain, used to deliver and execute malicious payloads. The detection rule provided by Elastic identifies suspicious msiexec.exe activity by monitoring process starts, network connections, and child processes. It filters out known benign signatures and paths to highlight potential misuse. This detection is designed to work with Elastic Defend data.

Attack Chain

An attacker gains initial access via phishing (T1566) or other means to execute commands on the target system.
The attacker uses msiexec.exe with the /V parameter to initiate the installation of a remote MSI package. This allows the attacker to bypass typical execution restrictions.
Msiexec.exe attempts a network connection (T1105) to retrieve the remote MSI package from a malicious server.
Msiexec.exe spawns a child process to handle the installation of the downloaded MSI package.
The spawned child process executes malicious code embedded within the MSI package.
The malicious code performs actions such as installing malware, modifying system settings, or establishing persistence.
The attacker leverages the compromised system for further lateral movement or data exfiltration.

Impact

Successful exploitation can lead to the installation of malware, unauthorized access to sensitive data, and further compromise of the affected system and network. While this specific rule has a low risk score, it can be an early indicator of more serious attacks. It is crucial to investigate any alerts generated by this rule to determine the full scope and impact of the potential compromise.

Recommendation

Deploy the Sigma rule provided below to your SIEM to detect suspicious usage of msiexec.exe to install remote packages. Tune the rule for your environment by adding exceptions for legitimate software installation processes.
Enable process monitoring and network connection logging on Windows endpoints to provide the necessary data for the Sigma rule to function effectively (Data Source: Elastic Defend).
Review the “Possible investigation steps” section in the Elastic rule’s documentation to investigate potential false positives and legitimate uses of msiexec.exe.
Implement application control policies to restrict the execution of unauthorized applications, including potentially malicious MSI packages.

MsiExec Child Process Spawning Network Connections for Defense Evasion

hello@craftedsignal.io — Sat, 26 Oct 2024 12:00:00 +0000

Adversaries may abuse the Windows Installer service (msiexec.exe) to proxy the execution of malicious payloads, effectively bypassing application control and other security mechanisms. This technique, known as “Msiexec” proxy execution (T1218.007), involves using msiexec.exe to execute malicious DLLs or scripts. The detection focuses on identifying child processes spawned by MsiExec, particularly those exhibiting network activity. This behavior is atypical for legitimate software installations and updates, making it a strong indicator of potential malicious use. Defenders should be aware of this technique as it allows attackers to blend in with legitimate system processes. The Elastic detection rule, updated on 2026-05-04, aims to identify this suspicious activity across multiple data sources including Elastic Defend, Sysmon, and SentinelOne.

Attack Chain

Attacker gains initial access to the system through an exploit or social engineering.
Attacker leverages msiexec.exe to execute a malicious MSI package with a /v parameter, commonly used to pass verbose logging options, potentially hiding malicious commands.
The malicious MSI package contains custom actions that execute arbitrary code.
Msiexec.exe spawns a child process (e.g., powershell.exe, cmd.exe, or another executable) to carry out malicious actions.
The child process establishes a network connection to an external server or performs DNS lookups, possibly for command and control (C2) communication or to download additional payloads.
The attacker uses the network connection to download and execute further tools or scripts.
The attacker performs lateral movement within the network.
The final objective could be data exfiltration, ransomware deployment, or persistent access.

Impact

Successful exploitation allows attackers to bypass application control and execute arbitrary code on the system. This can lead to malware installation, data theft, or complete system compromise. While the exact number of victims is not specified in the provided source, the technique can be applied across various sectors. The impact can range from individual workstation compromises to large-scale breaches affecting entire organizations.

Recommendation

Deploy the Sigma rule MsiExec Child Process with Unusual Executable and Network Connection to detect suspicious msiexec.exe child processes initiating network connections based on unusual executable paths.
Enable Sysmon process creation logging (Event ID 1) and network connection logging (Event ID 3) to provide the necessary data for the Sigma rule.
Investigate any alerts triggered by the Sigma rules, focusing on the process tree, command-line arguments, and network destinations.
Review and whitelist legitimate software installations and automated deployment tools that use MsiExec and require network access to minimize false positives, as detailed in the “False positive analysis” section of the source material.

Potential Remote Install via MsiExec

hello@craftedsignal.io — Mon, 29 Jan 2024 10:00:00 +0000

Adversaries may abuse Windows Installer (msiexec.exe) to perform remote installations of malicious payloads. This technique is used for initial access, defense evasion, and execution of arbitrary code. The detection rule identifies attempts to install a file from a remote server using MsiExec. The rule looks for msiexec.exe processes running with arguments such as -i, /i, -p, or /p, indicative of remote installations, and executed from suspicious parent processes like sihost.exe, explorer.exe, cmd.exe, wscript.exe, mshta.exe, powershell.exe, wmiprvse.exe, pcalua.exe, forfiles.exe, and conhost.exe. The rule includes exceptions to reduce false positives from legitimate software installations, specifically excluding command lines containing --set-server, UPGRADEADD, --url, USESERVERCONFIG, RCTENTERPRISESERVER, app.ninjarmm.com, zoom.us/client, SUPPORTSERVERSTSURI, START_URL, AUTOCONFIG, awscli.amazonaws.com, */i \"C:*, and */i C:\\*. This technique can lead to complete system compromise and data exfiltration.

Attack Chain

An attacker gains initial access via an unspecified method (e.g., phishing, exploit).
The attacker uses a script or command-line interpreter (e.g., cmd.exe, powershell.exe) to initiate the msiexec.exe process.
The msiexec.exe process is launched with arguments that specify a remote MSI package (-i, /i, -p, /p) and enable silent installation (/qn, -qn, -q, /q, /quiet).
The msiexec.exe process downloads the MSI package from a remote server over HTTP or HTTPS.
msiexec.exe executes the downloaded MSI package, which may contain malicious payloads.
The malicious payload executes, potentially performing actions such as installing malware, establishing persistence, or escalating privileges.
The attacker gains control over the compromised system.
The attacker performs further actions, such as data exfiltration or lateral movement.

Impact

Successful exploitation can lead to arbitrary code execution, allowing attackers to install malware, steal sensitive data, or disrupt system operations. A compromised system can be used as a pivot point to access other systems on the network. The impact can range from data breaches and financial losses to reputational damage and disruption of critical services. The number of potential victims depends on the scope of the initial access and the attacker’s objectives.

Recommendation

Deploy the provided Sigma rule to your SIEM to detect suspicious MsiExec invocations with remote payloads.
Enable Sysmon process creation logging (Event ID 1) to ensure the required data is available for the Sigma rule.
Investigate any alerts generated by the Sigma rule, focusing on the parent process, command-line arguments, and network connections associated with the msiexec.exe process.
Monitor process execution events for child processes spawned by msiexec.exe for anomalous activity.
Implement application control policies to restrict the execution of msiexec.exe to authorized users and processes only.

Suspicious MSIExec Remote Download

hello@craftedsignal.io — Wed, 03 Jan 2024 15:00:00 +0000

The detection focuses on identifying instances where msiexec.exe is used with an HTTP or HTTPS URL in the command line. This behavior is indicative of an attempt to download and execute potentially malicious software from a remote server. The detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant as it may indicate an attempt to download and execute potentially malicious software from a remote server. If confirmed malicious, this could lead to unauthorized code execution, system compromise, or further malware deployment within the network. The activity is often used to bypass traditional security controls.

Attack Chain

An attacker gains initial access through various means, such as phishing or exploiting a software vulnerability.
The attacker leverages msiexec.exe, a legitimate Windows utility, to download a malicious MSI package from a remote HTTP or HTTPS server.
The command line includes a URL pointing to a malicious MSI file hosted on a compromised or attacker-controlled server.
msiexec.exe downloads the MSI package to the victim’s machine.
The MSI package is executed, potentially installing malware, creating new files, or modifying system settings.
The installed malware establishes persistence through registry keys or scheduled tasks.
The malware initiates command and control (C2) communication to receive further instructions.
The attacker performs actions on the objective such as data exfiltration or lateral movement within the compromised network.

Impact

Successful exploitation can lead to unauthorized code execution, system compromise, or further malware deployment within the network. The use of msiexec.exe for remote downloads can bypass traditional security controls, allowing attackers to deliver and execute malicious payloads undetected. The dfirreport.com article references data exfiltration following exploitation via MSIExec.

Recommendation

Enable Sysmon process-creation logging to activate the rules below, capturing command-line details (Sysmon EventID 1).
Deploy the Sigma rules in this brief to your SIEM and tune for your environment.
Monitor network traffic for connections originating from msiexec.exe to external HTTP/HTTPS URLs (Network Visibility Module Flow Data).
Investigate any instances of msiexec.exe executing with command-line arguments containing HTTP or HTTPS URLs.
Filter false positives by destination or parent process as needed based on your environment.

MSIExec Spawning Discovery Commands

hello@craftedsignal.io — Wed, 03 Jan 2024 14:30:00 +0000

This detection focuses on identifying suspicious behavior where msiexec.exe, a legitimate Windows utility for installing, uninstalling, and configuring software, is used to spawn multiple discovery commands. This activity is often associated with attackers attempting to gather system information, enumerate the network, and identify potential targets for lateral movement. The technique is typically observed post-compromise, after initial access has been achieved through other means. This behavior matters to defenders as it is a key indicator of malicious activity and potential privilege escalation or data exfiltration attempts. The detection leverages Endpoint Detection and Response (EDR) data, specifically process creation events, to identify instances where msiexec.exe is the parent process of common discovery tools.

Attack Chain

An attacker gains initial access to the system through a vulnerability, phishing, or other means.
The attacker leverages msiexec.exe to execute discovery commands.
msiexec.exe spawns processes such as ipconfig.exe, net.exe, systeminfo.exe, or wmic.exe to gather network configuration, user information, and system details.
The attacker uses commands within cmd.exe or powershell.exe to execute the discovery commands. For example, cmd.exe /c ipconfig /all or powershell.exe Get-NetIPConfiguration.
The attacker filters the output of these commands to identify valuable information such as domain names, user accounts, and system architecture.
The attacker uses the gathered information to identify potential targets for lateral movement and privilege escalation.
The attacker attempts to move laterally to other systems using stolen credentials or exploits.

Impact

Successful exploitation of this technique can lead to a comprehensive understanding of the compromised environment. Attackers can leverage gathered information to escalate privileges, move laterally to other systems, and ultimately exfiltrate sensitive data or deploy ransomware. The impact could range from a single compromised workstation to a complete network breach, depending on the scope of the attacker’s activity.

Recommendation

Enable process monitoring and command-line logging on all endpoints to capture the necessary data for detection.
Deploy the Sigma rule MSIExec Spawning Discovery Commands to your SIEM and tune it to your environment.
Investigate any instances of msiexec.exe spawning multiple discovery commands, as this behavior is unusual in normal system operations.
Implement least privilege principles to limit the impact of compromised accounts and prevent lateral movement.

Msiexec Arbitrary DLL Execution

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

Msiexec.exe is the command-line utility for the Windows Installer, commonly used to execute installation packages (.msi). Attackers are known to abuse msiexec.exe to proxy the execution of arbitrary DLLs, a technique that helps bypass application control and evade detection. This approach leverages the trusted nature of msiexec.exe to execute malicious code, making it harder for security tools to identify and block the activity. The abuse of msiexec.exe has been observed in various attack campaigns, highlighting the need for defenders to monitor its usage closely.

Attack Chain

An attacker gains initial access to the target system, often through phishing or exploitation of a vulnerability.
The attacker uploads a malicious DLL to the compromised system.
The attacker uses msiexec.exe with the /Y flag to execute the malicious DLL. This flag is used to trigger DLL execution via msiexec.
Msiexec.exe loads and executes the malicious DLL.
The malicious DLL performs its intended actions, such as establishing persistence, escalating privileges, or deploying additional malware.
The attacker may use the proxy execution through msiexec.exe to evade detection by security tools monitoring process execution.
The attacker pivots to other systems or begins data exfiltration.
The ultimate objective is often data theft, system compromise, or ransomware deployment.

Impact

Successful exploitation allows attackers to execute arbitrary code on the targeted system, potentially leading to a full system compromise. This can result in data breaches, financial loss, and reputational damage. The technique is particularly effective at bypassing application control solutions, increasing the likelihood of a successful attack. While specific victim counts are unavailable, the widespread use of Windows Installer makes this a relevant threat across various sectors.

Recommendation

Deploy the Sigma rule Suspicious Msiexec Execute Arbitrary DLL to your SIEM to detect the execution of msiexec.exe with the /Y flag, indicative of potential malicious DLL execution.
Investigate any instances of msiexec.exe executing DLLs from unusual or temporary locations.
Implement application control policies to restrict the execution of msiexec.exe to authorized users and legitimate installation processes.
Monitor process creation events for msiexec.exe to identify suspicious command-line arguments and parent processes.