Msiexec Abuse (Sysmon)

id: '6847.8063'
title: Msiexec Abuse
description: 'Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.
  Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly
  associated with executing installation packages (.msi). This use case looks for
  msiexec launching filetypes other than ".msi" Software Association: Raspberry Robin,
  Zloader Atomics T1218.007 Test #9 Atomics T1218.007 Test #10'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<"
  ) TERM(msiexec) NOT ".msi" | regex process="(?i)msiexec.*?\.\w{2,5}"| table _time,
  host, user parent_*, process, process_*, signature_id | bin span=1s | stats values(*)
  as * by _time, host | eventstats dc(process) as dc_process by host | where dc_process
  < 10 '
techniques:
- defense-evasion:system binary proxy execution:msiexec
technique_id:
- T1218.007
data_category:
- Process command-line parameters
- Windows Sysmon
references:
- https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/
- https://lolbas-project.github.io/lolbas/Binaries/Msiexec/