detection.wiki

Detection rules › Sigma

Msiexec.EXE Initiated Network Connection Over HTTP

Status
test
Severity
low
Log source
product windows, category network_connection
Author
frack113
Source
github.com/SigmaHQ/sigma

Detects a network connection initiated by an "Msiexec.exe" process over port 80 or 443. Adversaries might abuse "msiexec.exe" to install and execute remotely hosted packages. Use this rule to hunt for potentially anomalous or suspicious communications.

MITRE ATT&CK coverage

TacticTechniques
StealthT1218.007 System Binary Proxy Execution: Msiexec

Event coverage

ProviderEventTitle
SysmonEvent ID 3Network connection

Rule body yaml

title: Msiexec.EXE Initiated Network Connection Over HTTP
id: 8e5e38e4-5350-4c0b-895a-e872ce0dd54f
status: test
description: |
    Detects a network connection initiated by an "Msiexec.exe" process over port 80 or 443.
    Adversaries might abuse "msiexec.exe" to install and execute remotely hosted packages.
    Use this rule to hunt for potentially anomalous or suspicious communications.
references:
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md
author: frack113
date: 2022-01-16
modified: 2024-07-16
tags:
    - attack.stealth
    - attack.t1218.007
    - detection.threat-hunting
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: 'true'
        Image|endswith: '\msiexec.exe'
        DestinationPort:
            - 80
            - 443
    condition: selection
falsepositives:
    - Likely
level: low

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    Initiated: 'true'
    Image|endswith: '\msiexec.exe'
    DestinationPort:
        - 80
        - 443

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
DestinationPorteq
  • 443 corpus 5 (sigma 5)
  • 80 corpus 10 (sigma 6, elastic 2, kusto 2)
Imageends_with
  • \msiexec.exe corpus 21 (sigma 21)
Initiatedeq
  • true corpus 50 (sigma 50)