Remote .msi Installation (PowerShell)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi). The Msiexec.exe binary may also be digitally signed by Microsoft. This use case detects attempts to install .msi from remote locations

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1218.007` System Binary Proxy Execution: Msiexec

References

https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md#atomic-test-11---msiexecexe---execute-remote-msi-file

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4103: Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).

Rule body

id: '18093.30601'
title: Remote .msi Installation
description: 'Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.
  Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly
  associated with executing installation packages (.msi). The Msiexec.exe binary may
  also be digitally signed by Microsoft. This use case detects attempts to install
  .msi from remote locations. -- Threat Actor Association: APT-K-47/Mysterious Elephant
  -- Atomics T1218.007 Test #11'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") (TERM(/i) OR TERM(install))
  ".msi" | where match(process, "(?i)\w+tps?://\S+\.msi") | table _time, host, user
  process, process_*, parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:msiexec
technique_id:
- T1218.007
data_category:
- PowerShell logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md#atomic-test-11---msiexecexe---execute-remote-msi-file

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") (TERM(/i) OR TERM(install)) ".msi"

Stage 2: `where`

| where match(process, "(?i)\w+tps?://\S+\.msi")

Stage 3: `table`

| table _time, host, user process, process_*, parent_*

Stage 4: `bucket`

| bin span=1s

Stage 5: `stats`

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`4103` corpus 105 (splunk 105) `4104` corpus 269 (splunk 269)	`field:"EventID" kind:eq`
`process`	regex_match	`"(?i)\w+tps?://\S+.msi"` corpus 6 (splunk 6)	`field:"CommandLine" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"<EventID>4103<"`
1	`"<EventID>4104<"`
1	`"/i"`
1	`install`
1	`".msi"`