Detection rules › Elastic
Windows Installer with Suspicious Properties
Identifies the execution of an installer from an archive or with suspicious properties. Adversaries may abuse msiexec.exe to launch local or network accessible MSI files in an attempt to bypass application whitelisting.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1218.007 System Binary Proxy Execution: Msiexec |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Sysmon | Event ID 12 | RegistryEvent (Object create and delete) |
| Sysmon | Event ID 13 | RegistryEvent (Value Set) |
| Sysmon | Event ID 14 | RegistryEvent (Key and Value Rename) |
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body elastic
[metadata]
creation_date = "2023/09/26"
integration = ["endpoint"]
maturity = "production"
updated_date = "2024/08/05"
[rule]
author = ["Elastic"]
building_block_type = "default"
description = """
Identifies the execution of an installer from an archive or with suspicious properties. Adversaries may abuse
msiexec.exe to launch local or network accessible MSI files in an attempt to bypass application whitelisting.
"""
from = "now-119m"
index = ["logs-endpoint.events.*"]
interval = "60m"
language = "eql"
license = "Elastic License v2"
name = "Windows Installer with Suspicious Properties"
references = ["https://lolbas-project.github.io/lolbas/Binaries/Msiexec/"]
risk_score = 21
rule_id = "55f07d1b-25bc-4a0f-aa0c-05323c1319d0"
severity = "low"
tags = [
"Domain: Endpoint",
"OS: Windows",
"Use Case: Threat Detection",
"Tactic: Defense Evasion",
"Rule Type: BBR",
"Data Source: Elastic Defend",
]
type = "eql"
query = '''
sequence with maxspan=1m
[registry where host.os.type == "windows" and event.type == "change" and process.name : "msiexec.exe" and
(
(registry.value : "InstallSource" and
registry.data.strings : ("?:\\Users\\*\\Temp\\Temp?_*.zip\\*",
"?:\\Users\\*\\*.7z\\*",
"?:\\Users\\*\\*.rar\\*")) or
(registry.value : ("DisplayName", "ProductName") and registry.data.strings : "SetupTest")
)]
[process where host.os.type == "windows" and event.action == "start" and
process.parent.name : "msiexec.exe" and
not process.name : "msiexec.exe" and
not (process.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe") and process.code_signature.trusted == true)]
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[rule.threat.technique.subtechnique]]
id = "T1218.007"
name = "Msiexec"
reference = "https://attack.mitre.org/techniques/T1218/007/"
[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
Stages and Predicates
Stage 1: registry
[registry where host.os.type == "windows" and event.type == "change" and process.name : "msiexec.exe" and
(
(registry.value : "InstallSource" and
registry.data.strings : ("?:\\Users\\*\\Temp\\Temp?_*.zip\\*",
"?:\\Users\\*\\*.7z\\*",
"?:\\Users\\*\\*.rar\\*")) or
(registry.value : ("DisplayName", "ProductName") and registry.data.strings : "SetupTest")
)]
Stage 2: process
[process where host.os.type == "windows" and event.action == "start" and
process.parent.name : "msiexec.exe" and
not process.name : "msiexec.exe" and
not (process.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe") and process.code_signature.trusted == true)]
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
process.code_signature.trusted | eq | true |
process.executable | wildcard | ?:\Program Files (x86)\*.exe, ?:\Program Files\*.exe |
process.name | eq | msiexec.exe |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
event.action | eq |
|
event.type | eq |
|
process.name | wildcard |
|
process.parent.name | wildcard |
|
registry.data.strings | wildcard |
|
registry.value | wildcard |
|