Suspicious Msiexec Quiet Install From Remote Location

Title: Suspicious Msiexec Quiet Install From Remote Location
Status: test
Description:Detects usage of Msiexec.exe to install packages hosted remotely quietly
References:
  -https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-28
modified:2025-10-07
Tags:

• -'attack.stealth'
• -'attack.t1218.007'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\msiexec.exe' OriginalFileName:'msiexec.exe'   selection_cli:
    CommandLine|contains|windash:
      -'-i'
      -'-package'
      -'-a'
      -'-j'

  selection_quiet:
    CommandLine|contains|windash: '-q'
  selection_remote:
    CommandLine|contains:
      -'http'
      -'\\\\'

  filter_optional_openoffice:
    CommandLine|contains|all:
      -'\AppData\Local\Temp\OpenOffice'
      -'Installation Files\openoffice'

  condition:all of selection_* and not 1 of filter_optional_*
Falsepositives:
  -Unknown
Level: medium