Remote MSI Package Installation via MSIEXEC

[rule]
description = """
Identifies the execution of the built-in Windows Installer, MSIEXEC, to install a remote package. Adversaries may abuse
msiexec.exe to launch local or network accessible MSI files.
"""
id = "706bf4ca-45b7-4eb1-acae-b1228124594a"
license = "Elastic License v2"
name = "Remote MSI Package Installation via MSIEXEC"
os_list = ["windows"]
reference = [
    "https://lolbas-project.github.io/lolbas/Binaries/Msiexec/",
    "https://www.guardicore.com/labs/purple-fox-rootkit-now-propagates-as-a-worm/",
]
version = "1.0.32"

query = '''
sequence with maxspan=1m
  [registry where process.name : "msiexec.exe" and
    registry.value : "InstallSource" and registry.data.strings : "http*" and
    not registry.data.strings : "https://statics.teams.cdn.office.net/*"]
  [process where event.action == "start" and user.id : ("S-1-5-21*", "S-1-12-*") and
    descendant of [process where process.name : "msiexec.exe"]  and
    not (process.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe") and process.code_signature.trusted == true) and
    not process.executable : ("?:\\Windows\\System32\\MsiExec.exe", "?:\\Windows\\syswow64\\MsiExec.exe", "?:\\WINDOWS\\Installer\\MSI*.tmp",
                              "C:\\Program Files (x86)\\AMS Services\\TransactNOW\\OALaunch.exe") and
    not (process.code_signature.subject_name : ("Ellie Mae, Inc.", "Chatgenie LLC") and process.code_signature.trusted == true)]
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.007"
name = "Msiexec"
reference = "https://attack.mitre.org/techniques/T1218/007/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"