Remote-Install

This rule detects attempts to install a file from a remote server using MsiExec, which adversaries may abuse to deliver malware, by identifying msiexec.exe processes running with arguments indicative of remote installations and executed from suspicious parent processes.

Adversaries may abuse Windows Installers via MsiExec to install files from remote servers for initial access and delivery of malware, which is detected by identifying MsiExec processes with network connections and specific command-line arguments.