System Binary Proxy Execution: Msiexec T1218.007

Events covered

14 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 51 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (40 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Top indicator values (357 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Exclusions (137 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 10 rules

• DllUnregisterServer Function Call Via Msiexec.EXE
• MSI Installation From Web
• Msiexec Quiet Installation
• MsiExec Web Install
• Msiexec.EXE Initiated Network Connection Over HTTP
• Obfuscated PowerShell MSI Install via WindowsInstaller COM
• PowerShell WMI Win32_Product Install MSI
• Suspicious MsiExec Embedding Parent
• Suspicious Msiexec Execute Arbitrary DLL
• Suspicious Msiexec Quiet Install From Remote Location

Elastic 14 rules

• Execution of a Downloaded Windows Script
• MsiExec Service Child Process With Network Connection
• Persistence via a Windows Installer
• Potential Escalation via Vulnerable MSI Repair
• Potential Remote File Execution via MSIEXEC
• Potential Remote Install via MsiExec
• Suspicious Execution from a Mounted Device
• Suspicious Execution from VS Code Extension
• Suspicious Execution via MSIEXEC
• Suspicious JetBrains TeamCity Child Process
• Suspicious Microsoft HTML Application Child Process
• Suspicious ScreenConnect Client Child Process
• Unusual Network Activity from a Windows System Binary
• Windows Installer with Suspicious Properties

Splunk 26 rules

• MSI Installation via Appcert (PowerShell)
• MSI Installation via Appcert (Sysmon)
• MSI Installation via Appcert (Windows Event Log)
• Msiexec Abuse (Sysmon)
• Msiexec Abuse (Windows Event Log)
• MSIExec Install MSI File (Sysmon)
• MSIExec Install MSI File (Windows Event Log)
• MSIExec.exe Execution (Sysmon)
• MSIExec.exe Execution (Windows Event Log)
• Remote .msi Installation (PowerShell)
• Remote .msi Installation (PowerShell)
• Remote .msi Installation (Sysmon)
• Remote .msi Installation (Sysmon)
• Remote .msi Installation (Windows Event Log)
• Remote .msi Installation (Windows Event Log)
• Suspicious Parent Process for msiexec.exe (Sysmon)
• Suspicious Parent Process for msiexec.exe (Windows Event Log)
• Uninstall App Using MsiExec
• Windows HTTP Network Communication From MSIExec
• Windows MSI Rollback Script Deleted By Non-Msiexec Process
• Windows MSIExec DLLRegisterServer
• Windows MsiExec HideWindow Rundll32 Execution
• Windows MSIExec Remote Download
• Windows MSIExec Spawn Discovery Command
• Windows MSIExec Spawn WinDBG
• Windows MSIExec Unregister DLLRegisterServer

Kusto 1 rule

• Detect Msiexec executing DLL network connections