Detection rules › Sigma
MSI Installation From Suspicious Locations
Detects MSI package installation from suspicious locations
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | No specific technique |
Event coverage
| Provider | Event | Title |
|---|---|---|
| MsiInstaller | Event ID 1040 | Beginning a Windows Installer transaction: %0 |
| MsiInstaller | Event ID 1042 | Ending a Windows Installer transaction: %0 |
Rule body yaml
title: MSI Installation From Suspicious Locations
id: c7c8aa1c-5aff-408e-828b-998e3620b341
status: test
description: Detects MSI package installation from suspicious locations
references:
- https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-31
modified: 2023-10-23
tags:
- attack.execution
logsource:
product: windows
service: application
# warning: The 'data' field used in the detection section is the container for the event data as a whole. You may have to adapt the rule for your backend accordingly
detection:
selection:
Provider_Name: 'MsiInstaller'
EventID:
- 1040
- 1042
Data|contains:
# Add more suspicious paths
- ':\Windows\TEMP\'
- '\\\\'
- '\Desktop\'
- '\PerfLogs\'
- '\Users\Public\'
# - '\AppData\Local\Temp\' # too many FPs
# - '\Downloads\' # too many FPs, typical legitimate staging directory
filter_winget:
Data|contains: '\AppData\Local\Temp\WinGet\'
filter_updhealthtools:
Data|contains: 'C:\Windows\TEMP\UpdHealthTools.msi'
condition: selection and not 1 of filter_*
falsepositives:
- False positives may occur if you allow installation from folders such as the desktop, the public folder or remote shares. A baseline is required before production use.
level: medium
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_*Stage 1: selection
selection:
Provider_Name: 'MsiInstaller'
EventID:
- 1040
- 1042
Data|contains:
- ':\Windows\TEMP\'
- '\\\\'
- '\Desktop\'
- '\PerfLogs\'
- '\Users\Public\'
Stage 2: not filter_*
filter_winget:
Data|contains: '\AppData\Local\Temp\WinGet\'
filter_updhealthtools:
Data|contains: 'C:\Windows\TEMP\UpdHealthTools.msi'
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
Data | match | C:\Windows\TEMP\UpdHealthTools.msi |
Data | match | \AppData\Local\Temp\WinGet\ |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Data | match |
|
Provider_Name | eq |
|