Detection rules › Splunk
MSIExec Install MSI File (Windows Event Log)
The Windows Installer technology uses Msiexec.exe for installing MSI and MSP packages. This tool gives you full control over the installation process
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1218.007 System Binary Proxy Execution: Msiexec |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| MsiInstaller | Event ID 1040 | Beginning a Windows Installer transaction: %0 |
Rule body yaml
id: '1117.1196'
title: MSIExec Install MSI File
description: 'The Windows Installer technology uses Msiexec.exe for installing MSI
and MSP packages. This tool gives you full control over the installation process.
-- Threat Actor Association: APT-K-47/Mysterious Elephant, APT36, TA505 -- Software
Association: Clop, DirtyMoe, Hive, MirrorBlast, Qakbot/Qbot, Yellow Cockatoo/Jupiter
Infostealer, Zloader -- LOLBAS -- Atomics T1218.007 Test #1 Atomics T1218.007 Test
#2 Atomics T1218.007 Test #3 Atomics T1218.007 Test #4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=1040) OR
"<EventID>1040<") TERM(MsiInstaller) OR TERM(ingress.event.procstart) | rex field=Message
"(?i)Beginning\sa\sWindows\sInstaller\stransaction:(\s+)?(?<process>.+)" | table
_time, host, user host, signature_id, user, process | bin span=1s | stats values(*)
as * by _time, host | eventstats dc(process) as c_process by process | where c_process
< 2 and isnotnull(process) '
techniques:
- defense-evasion:system binary proxy execution:msiexec
technique_id:
- T1218.007
data_category:
- Windows event logs
references:
- https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=1040) OR "<EventID>1040<") TERM(MsiInstaller) OR TERM(ingress.event.procstart)
Stage 2: rex
| rex field=Message "(?i)Beginning\sa\sWindows\sInstaller\stransaction:(\s+)?(?<process>.+)"
Stage 3: table
| table _time, host, user host, signature_id, user, process
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Stage 6: eventstats
| eventstats dc(process) as c_process by process
Stage 7: where
| where c_process < 2 and isnotnull(process)
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>1040<" |
| 1 | TERM |
| 1 | MsiInstaller |
| 1 | TERM |
| 1 | ingress.event.procstart |