Detection rules › Sigma

MSI Installation From Suspicious Locations

Status
test
Severity
medium
Log source
product windows, service application
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects MSI package installation from suspicious locations

MITRE ATT&CK coverage

TacticTechniques
ExecutionNo specific technique

Event coverage

Rule body yaml

title: MSI Installation From Suspicious Locations
id: c7c8aa1c-5aff-408e-828b-998e3620b341
status: test
description: Detects MSI package installation from suspicious locations
references:
    - https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-31
modified: 2023-10-23
tags:
    - attack.execution
logsource:
    product: windows
    service: application
    # warning: The 'data' field used in the detection section is the container for the event data as a whole. You may have to adapt the rule for your backend accordingly
detection:
    selection:
        Provider_Name: 'MsiInstaller'
        EventID:
            - 1040
            - 1042
        Data|contains:
            # Add more suspicious paths
            - ':\Windows\TEMP\'
            - '\\\\'
            - '\Desktop\'
            - '\PerfLogs\'
            - '\Users\Public\'
            # - '\AppData\Local\Temp\'  # too many FPs
            # - '\Downloads\'  # too many FPs, typical legitimate staging directory
    filter_winget:
        Data|contains: '\AppData\Local\Temp\WinGet\'
    filter_updhealthtools:
        Data|contains: 'C:\Windows\TEMP\UpdHealthTools.msi'
    condition: selection and not 1 of filter_*
falsepositives:
    - False positives may occur if you allow installation from folders such as the desktop, the public folder or remote shares. A baseline is required before production use.
level: medium

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_*

Stage 1: selection

selection:
    Provider_Name: 'MsiInstaller'
    EventID:
        - 1040
        - 1042
    Data|contains:
        - ':\Windows\TEMP\'
        - '\\\\'
        - '\Desktop\'
        - '\PerfLogs\'
        - '\Users\Public\'

Stage 2: not filter_*

filter_winget:
    Data|contains: '\AppData\Local\Temp\WinGet\'
filter_updhealthtools:
    Data|contains: 'C:\Windows\TEMP\UpdHealthTools.msi'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
DatamatchC:\Windows\TEMP\UpdHealthTools.msi
Datamatch\AppData\Local\Temp\WinGet\

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Datamatch
  • :\Windows\TEMP\
  • \Desktop\ corpus 2 (sigma 2)
  • \PerfLogs\ corpus 2 (sigma 2)
  • \Users\Public\ corpus 2 (sigma 2)
  • \\\\
Provider_Nameeq
  • MsiInstaller corpus 5 (sigma 5)