Detection rules › Sigma
Suspicious MsiExec Embedding Parent
Adversaries may abuse msiexec.exe to proxy the execution of malicious payloads
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1218.007 System Binary Proxy Execution: Msiexec |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
Rule body yaml
title: Suspicious MsiExec Embedding Parent
id: 4a2a2c3e-209f-4d01-b513-4155a540b469
status: test
description: Adversaries may abuse msiexec.exe to proxy the execution of malicious payloads
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md
author: frack113
date: 2022-04-16
modified: 2022-07-14
tags:
- attack.stealth
- attack.t1218.007
logsource:
product: windows
category: process_creation
detection:
selection:
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
- '\cmd.exe'
ParentCommandLine|contains|all:
- 'MsiExec.exe'
- '-Embedding '
filter_splunk_ufw:
Image|endswith: ':\Windows\System32\cmd.exe'
CommandLine|contains: 'C:\Program Files\SplunkUniversalForwarder\bin\'
filter_vs:
- CommandLine|contains: '\DismFoDInstall.cmd'
- ParentCommandLine|contains|all:
- '\MsiExec.exe -Embedding '
- 'Global\MSI0000'
condition: selection and not 1 of filter*
falsepositives:
- Unknown
level: medium
Stages and Predicates
Stage 0: condition
selection and not 1 of filter*Stage 1: selection
selection:
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
- '\cmd.exe'
ParentCommandLine|contains|all:
- 'MsiExec.exe'
- '-Embedding '
Stage 2: not filter*
filter_splunk_ufw:
Image|endswith: ':\Windows\System32\cmd.exe'
CommandLine|contains: 'C:\Program Files\SplunkUniversalForwarder\bin\'
filter_vs:
- CommandLine|contains: '\DismFoDInstall.cmd'
- ParentCommandLine|contains|all:
- '\MsiExec.exe -Embedding '
- 'Global\MSI0000'
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
CommandLine | match | C:\Program Files\SplunkUniversalForwarder\bin\ |
Image | ends_with | :\Windows\System32\cmd.exe |
ParentCommandLine | match | Global\MSI0000 |
ParentCommandLine | match | \MsiExec.exe -Embedding |
CommandLine | match | \DismFoDInstall.cmd |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Image | ends_with |
|
ParentCommandLine | match |
|