Skip to content
Threat Feed

Tag

Rollback

1 brief RSS
high advisory

Windows MSI Rollback Script Deletion by Non-Msiexec Process

Detection of a rollback script (.rbs) file deletion under C:\Config.Msi by a non-msiexec.exe process, indicating a potential MSI rollback privilege escalation attack.

Splunk Enterprise +2 privilege-escalation rollback windows
2r 2t 1c