Detection rules › Splunk
Remote .msi Installation (Windows Event Log)
Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi). The Msiexec.exe binary may also be digitally signed by Microsoft. This use case detects attempts to install .msi from remote locations
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1218.007 System Binary Proxy Execution: Msiexec |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4688 | A new process has been created. |
| MsiInstaller | Event ID 1040 | Beginning a Windows Installer transaction: %0 |
| MsiInstaller | Event ID 1042 | Ending a Windows Installer transaction: %0 |
Rule body yaml
id: '18093.30444'
title: Remote .msi Installation
description: 'Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.
Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly
associated with executing installation packages (.msi). The Msiexec.exe binary may
also be digitally signed by Microsoft. This use case detects attempts to install
.msi from remote locations. -- Threat Actor Association: APT-K-47/Mysterious Elephant
-- Atomics T1218.007 Test #11'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4688) OR
"<EventID>4688<" OR Type=Process) (TERM(/i) OR TERM(install)) ".msi") OR (TERM(EventCode=1040)
OR TERM(EventCode=1042) OR "<EventID>1040<" OR "<EventID>1042<") "://" | where (match(process,
"(?i)\w+tps?://\S+\.msi") and match(signature_id, "4688")) or (match(message, "(?i)\w+tps?://\S+\.msi")
and match(signature_id, "1040|1042")) | table _time, host, user process, process_*,
parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:msiexec
technique_id:
- T1218.007
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md#atomic-test-11---msiexecexe---execute-remote-msi-file
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) (TERM(/i) OR TERM(install)) ".msi") OR (TERM(EventCode=1040) OR TERM(EventCode=1042) OR "<EventID>1040<" OR "<EventID>1042<") "://"
Stage 2: where
| where (match(process, "(?i)\w+tps?://\S+\.msi") and match(signature_id, "4688")) or (match(message, "(?i)\w+tps?://\S+\.msi") and match(signature_id, "1040|1042"))
Stage 3: table
| table _time, host, user process, process_*, parent_*
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
message | match |
|
process | match |
|
signature_id | match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4688<" |
| 1 | "/i" |
| 1 | TERM |
| 1 | install |
| 1 | ".msi" |
| 1 | TERM |
| 1 | TERM |
| 1 | "<EventID>1040<" |
| 1 | "<EventID>1042<" |
| 1 | "://" |