Suspicious DLLRegisterServer Execution via MSIEXEC

[rule]
description = """
Identifies the execution of the built-in Windows Installer, MSIEXEC, to execute code via calling the exported function
DLLRegisterServer from a suspicious module.
"""
id = "ed77616c-8f97-472b-bb15-532af004e82a"
license = "Elastic License v2"
name = "Suspicious DLLRegisterServer Execution via MSIEXEC"
os_list = ["windows"]
reference = [
    "https://lolbas-project.github.io/lolbas/Binaries/Msiexec/",
    "https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion",
]
version = "1.0.25"

query = '''
process where event.action == "start" and
 process.pe.original_file_name : "msiexec.exe" and process.args : ("/z", "/y", "-y", "-z") and
 not process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and
 not process.Ext.token.integrity_level_name == "system" and
 not (process.parent.executable : "?:\\Windows\\Sys*\\msiexec.exe" and process.parent.args : "/V") and
 not (process.args : "?:\\windows\\system32\\nise.dll" and process.parent.executable : "?:\\Windows\\System32\\runonce.exe")
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.007"
name = "Msiexec"
reference = "https://attack.mitre.org/techniques/T1218/007/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"