{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata — refreshed continuously.","feed_url":"https://feed.craftedsignal.io/tags/remote-install/","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":["Microsoft Defender XDR","SentinelOne Cloud Funnel","Elastic Defend","Elastic Endgame"],"_cs_severities":["high"],"_cs_tags":["defense-evasion","windows","msiexec","remote-install"],"_cs_type":"advisory","_cs_vendors":["Elastic","Microsoft","SentinelOne","Crowdstrike"],"content_html":"\u003cp\u003eAdversaries may abuse Windows Installer (msiexec.exe) to perform remote installations of malicious payloads. This technique is used for initial access, defense evasion, and execution of arbitrary code. The detection rule identifies attempts to install a file from a remote server using MsiExec. The rule looks for msiexec.exe processes running with arguments such as \u003ccode\u003e-i\u003c/code\u003e, \u003ccode\u003e/i\u003c/code\u003e, \u003ccode\u003e-p\u003c/code\u003e, or \u003ccode\u003e/p\u003c/code\u003e, indicative of remote installations, and executed from suspicious parent processes like \u003ccode\u003esihost.exe\u003c/code\u003e, \u003ccode\u003eexplorer.exe\u003c/code\u003e, \u003ccode\u003ecmd.exe\u003c/code\u003e, \u003ccode\u003ewscript.exe\u003c/code\u003e, \u003ccode\u003emshta.exe\u003c/code\u003e, \u003ccode\u003epowershell.exe\u003c/code\u003e, \u003ccode\u003ewmiprvse.exe\u003c/code\u003e, \u003ccode\u003epcalua.exe\u003c/code\u003e, \u003ccode\u003eforfiles.exe\u003c/code\u003e, and \u003ccode\u003econhost.exe\u003c/code\u003e. The rule includes exceptions to reduce false positives from legitimate software installations, specifically excluding command lines containing \u003ccode\u003e--set-server\u003c/code\u003e, \u003ccode\u003eUPGRADEADD\u003c/code\u003e, \u003ccode\u003e--url\u003c/code\u003e, \u003ccode\u003eUSESERVERCONFIG\u003c/code\u003e, \u003ccode\u003eRCTENTERPRISESERVER\u003c/code\u003e, \u003ccode\u003eapp.ninjarmm.com\u003c/code\u003e, \u003ccode\u003ezoom.us/client\u003c/code\u003e, \u003ccode\u003eSUPPORTSERVERSTSURI\u003c/code\u003e, \u003ccode\u003eSTART_URL\u003c/code\u003e, \u003ccode\u003eAUTOCONFIG\u003c/code\u003e, \u003ccode\u003eawscli.amazonaws.com\u003c/code\u003e, \u003ccode\u003e*/i \\\u0026quot;C:*\u003c/code\u003e, and \u003ccode\u003e*/i C:\\\\*\u003c/code\u003e. This technique can lead to complete system compromise and data exfiltration.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains initial access via an unspecified method (e.g., phishing, exploit).\u003c/li\u003e\n\u003cli\u003eThe attacker uses a script or command-line interpreter (e.g., \u003ccode\u003ecmd.exe\u003c/code\u003e, \u003ccode\u003epowershell.exe\u003c/code\u003e) to initiate the \u003ccode\u003emsiexec.exe\u003c/code\u003e process.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003emsiexec.exe\u003c/code\u003e process is launched with arguments that specify a remote MSI package (\u003ccode\u003e-i\u003c/code\u003e, \u003ccode\u003e/i\u003c/code\u003e, \u003ccode\u003e-p\u003c/code\u003e, \u003ccode\u003e/p\u003c/code\u003e) and enable silent installation (\u003ccode\u003e/qn\u003c/code\u003e, \u003ccode\u003e-qn\u003c/code\u003e, \u003ccode\u003e-q\u003c/code\u003e, \u003ccode\u003e/q\u003c/code\u003e, \u003ccode\u003e/quiet\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003emsiexec.exe\u003c/code\u003e process downloads the MSI package from a remote server over HTTP or HTTPS.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003emsiexec.exe\u003c/code\u003e executes the downloaded MSI package, which may contain malicious payloads.\u003c/li\u003e\n\u003cli\u003eThe malicious payload executes, potentially performing actions such as installing malware, establishing persistence, or escalating privileges.\u003c/li\u003e\n\u003cli\u003eThe attacker gains control over the compromised system.\u003c/li\u003e\n\u003cli\u003eThe attacker performs further actions, such as data exfiltration or lateral movement.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation can lead to arbitrary code execution, allowing attackers to install malware, steal sensitive data, or disrupt system operations. A compromised system can be used as a pivot point to access other systems on the network. The impact can range from data breaches and financial losses to reputational damage and disruption of critical services. The number of potential victims depends on the scope of the initial access and the attacker\u0026rsquo;s objectives.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to your SIEM to detect suspicious MsiExec invocations with remote payloads.\u003c/li\u003e\n\u003cli\u003eEnable Sysmon process creation logging (Event ID 1) to ensure the required data is available for the Sigma rule.\u003c/li\u003e\n\u003cli\u003eInvestigate any alerts generated by the Sigma rule, focusing on the parent process, command-line arguments, and network connections associated with the \u003ccode\u003emsiexec.exe\u003c/code\u003e process.\u003c/li\u003e\n\u003cli\u003eMonitor process execution events for child processes spawned by \u003ccode\u003emsiexec.exe\u003c/code\u003e for anomalous activity.\u003c/li\u003e\n\u003cli\u003eImplement application control policies to restrict the execution of \u003ccode\u003emsiexec.exe\u003c/code\u003e to authorized users and processes only.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-29T10:00:00Z","date_published":"2024-01-29T10:00:00Z","id":"/briefs/2024-01-29-msiexec-remote-payload/","summary":"This rule detects attempts to install a file from a remote server using MsiExec, which adversaries may abuse to deliver malware, by identifying msiexec.exe processes running with arguments indicative of remote installations and executed from suspicious parent processes.","title":"Potential Remote Install via MsiExec","url":"https://feed.craftedsignal.io/briefs/2024-01-29-msiexec-remote-payload/"}],"language":"en","title":"CraftedSignal Threat Feed — Remote-Install","version":"https://jsonfeed.org/version/1.1"}