Msiexec Abuse (Windows Event Log)

id: '6847.8062'
title: Msiexec Abuse
description: 'Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.
  Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly
  associated with executing installation packages (.msi). This use case looks for
  msiexec launching filetypes other than ".msi" Software Association: Raspberry Robin,
  Zloader Atomics T1218.007 Test #9 Atomics T1218.007 Test #10'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) TERM(msiexec) NOT ".msi" | regex process="(?i)msiexec.*?\.\w{2,5}"|
  table _time, host, user parent_*, process, process_*, signature_id | bin span=1s
  | stats values(*) as * by _time, host | eventstats dc(process) as dc_process by
  host | where dc_process < 10 '
techniques:
- defense-evasion:system binary proxy execution:msiexec
technique_id:
- T1218.007
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/
- https://lolbas-project.github.io/lolbas/Binaries/Msiexec/