MSIExec.exe Execution (Sysmon)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

msiexec.exe is a Windows system component used to install and modify software packages using Windows Installer. Threat actors may abuse msiexec.exe to install malicious software or execute scripts, leveraging its legitimate appearance to bypass security measures and gain persistence on a targeted system as observed in FlawedGrace attacks. This use case detects any execution of msiexec.exe

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1218.007` System Binary Proxy Execution: Msiexec

References

https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

id: '24144.44554'
title: MSIExec.exe Execution
description: msiexec.exe is a Windows system component used to install and modify
  software packages using Windows Installer. Threat actors may abuse msiexec.exe to
  install malicious software or execute scripts, leveraging its legitimate appearance
  to bypass security measures and gain persistence on a targeted system as observed
  in FlawedGrace attacks. This use case detects any execution of msiexec.exe. Living
  Off the Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  TERM(msiexec) OR "msiexec.exe" | regex process_name="(?i)msiexec\.exe" | table _time,
  host, user process, process_*, parent_process_name, parent_process_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:msiexec
technique_id:
- T1218.007
data_category:
- Windows Sysmon
references:
- https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<") TERM(msiexec) OR "msiexec.exe"

Stage 2: `regex`

| regex process_name="(?i)msiexec\.exe"

Stage 3: `table`

| table _time, host, user process, process_*, parent_process_name, parent_process_*

Stage 4: `bucket`

| bin span=1s

Stage 5: `stats`

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`1` corpus 241 (splunk 225, kusto 15, elastic 1)	`field:"EventID" kind:eq value:"1"`
`process_name`	regex_match	`"(?i)msiexec.exe"` corpus 2 (splunk 2)	`field:"process_name" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"<EventID>1<"`
1	`msiexec`
1	`"msiexec.exe"`