Remote .msi Installation (Windows Event Log)

id: '18093.30444'
title: Remote .msi Installation
description: 'Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.
  Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly
  associated with executing installation packages (.msi). The Msiexec.exe binary may
  also be digitally signed by Microsoft. This use case detects attempts to install
  .msi from remote locations. -- Threat Actor Association: APT-K-47/Mysterious Elephant
  -- Atomics T1218.007 Test #11'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(/i) OR TERM(install)) ".msi") OR (TERM(EventCode=1040)
  OR TERM(EventCode=1042) OR "<EventID>1040<" OR "<EventID>1042<") "://" | where (match(process,
  "(?i)\w+tps?://\S+\.msi") and match(signature_id, "4688")) or (match(message, "(?i)\w+tps?://\S+\.msi")
  and match(signature_id, "1040|1042")) | table _time, host, user process, process_*,
  parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:msiexec
technique_id:
- T1218.007
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md#atomic-test-11---msiexecexe---execute-remote-msi-file