Potential Lateral Movement via MSI ODBC Driver Install over DCOM

Group by: DeviceId, DeviceName, InitiatingProcessUniqueId, ProcessUniqueId
Author: Cyb3rMonk
Source: github.com/Cyb3r-Monk/Threat-Hunting-and-Detection

Detects Potential Lateral Movement via MSI Custom Actions to install ODBC Driver over DCOM remotely.

MITRE ATT&CK coverage

Tactic	Techniques
Lateral Movement	No specific technique

References

Telemetry coverage

Platform	Record / event type
Microsoft Defender for Endpoint	`DeviceImageLoadEvents` action `any`: Image load
Microsoft Defender for Endpoint	`DeviceNetworkEvents` action `InboundConnectionAccepted`: Inbound connection accepted
Microsoft Defender for Endpoint	`DeviceProcessEvents` action `any`: Process activity

Rule body

// Description: Detect Potential Lateral Movement via MSI ODBC Driver Installer over DCOM
// Author: Cyb3rMonk(https://x.com/Cyb3rMonk)
// Website: https://academy.bluraven.io 
// Reference: https://specterops.io/blog/2025/09/29/dcom-again-installing-trouble-lateral-movement-bof/
//
DeviceProcessEvents
| where InitiatingProcessParentFileName == "services.exe"
| where InitiatingProcessFileName == "msiexec.exe"
| where FileName == "msiexec.exe"
| project DeviceId, DeviceName, ProcessUniqueId
| join kind=inner (
    DeviceNetworkEvents
    | where ActionType == "InboundConnectionAccepted"
    | where InitiatingProcessFileName == "msiexec.exe"
    | distinct DeviceId
    ) on DeviceId
    | join kind=inner 
        DeviceImageLoadEvents
        on DeviceId, DeviceName, $left.ProcessUniqueId == $right.InitiatingProcessUniqueId
| project-away DeviceId1, DeviceName1, DeviceId2
| project-reorder TimeGenerated, ActionType, DeviceId, DeviceName, FolderPath, InitiatingProcessFileName

Stages and Predicates

Stage 1: `source`

DeviceProcessEvents

Stage 2: `where`

| where InitiatingProcessParentFileName == "services.exe"

Stage 3: `where`

| where InitiatingProcessFileName == "msiexec.exe"

Stage 4: `where`

| where FileName == "msiexec.exe"

Stage 5: `project`

| project DeviceId, DeviceName, ProcessUniqueId

Stage 6: `join`

| join kind=inner (
    DeviceNetworkEvents
    | where ActionType == "InboundConnectionAccepted"
    | where InitiatingProcessFileName == "msiexec.exe"
    | distinct DeviceId
    ) on DeviceId

Stage 7: `join`

| join kind=inner 
        DeviceImageLoadEvents
        on DeviceId, DeviceName, $left.ProcessUniqueId == $right.InitiatingProcessUniqueId

Stage 8: `project-away`

| project-away DeviceId1, DeviceName1, DeviceId2

Stage 9: `project-reorder`

| project-reorder TimeGenerated, ActionType, DeviceId, DeviceName, FolderPath, InitiatingProcessFileName

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ActionType`	eq	`InboundConnectionAccepted`	`field:"ActionType" kind:eq value:"InboundConnectionAccepted"`
`FileName`	eq	`msiexec.exe`	`field:"file_name" kind:eq value:"msiexec.exe"`
`InitiatingProcessFileName`	eq	`msiexec.exe`	`field:"parent_process_name" kind:eq value:"msiexec.exe"`
`InitiatingProcessParentFileName`	eq	`services.exe`	`field:"GrandParentImage" kind:eq value:"services.exe"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`DeviceId`	`project`
`DeviceName`	`project`
`ProcessUniqueId`	`project`

Potential Lateral Movement via MSI ODBC Driver Install over DCOM

MITRE ATT&CK coverage

References

Telemetry coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Stage 5: project

Stage 6: join

Stage 7: join

Stage 8: project-away

Stage 9: project-reorder

Indicators

Output fields

Stage 1: `source`

Stage 2: `where`

Stage 3: `where`

Stage 4: `where`

Stage 5: `project`

Stage 6: `join`

Stage 7: `join`

Stage 8: `project-away`

Stage 9: `project-reorder`