Msiexec Quiet Installation

Title: Msiexec Quiet Installation
Status: test
Description:Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)
References:
  -https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md
  -https://twitter.com/_st0pp3r_/status/1583914244344799235
Author: frack113
Date: 2022-01-16
modified:2026-07-28
Tags:

• -'attack.stealth'
• -'attack.t1218.007'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\msiexec.exe' OriginalFileName:'msiexec.exe'   selection_cli:
    CommandLine|contains|windash:
      -'-i'
      -'-package'
      -'-a'
      -'-j'

  selection_quiet:
    CommandLine|contains|windash: '-q'
  filter_main_system_temp:
    ParentImage|startswith: 'C:\Windows\Temp\'
  filter_main_ccm:
    ParentImage: 'C:\Windows\CCM\Ccm32BitLauncher.exe'
    IntegrityLevel:
      -'System'
      -'S-1-16-16384'

  filter_optional_user_temp:
    ParentImage|startswith: 'C:\Users\'
    ParentImage|contains: '\AppData\Local\Temp\'
  filter_optional_wsl:
    ParentImage|endswith: 'C:\Windows\System32\wsl.exe'
    Image|endswith: 'C:\Windows\System32\msiexec.exe'
  condition:all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
Falsepositives:
  -WindowsApps installing updates via the quiet flag
Level: medium