T1218.007Stealth
Msiexec
Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi). The Msiexec.exe binary may also be digitally signed by Microsoft. Adversaries may abuse msiexec.exe to launch local or network accessible MSI files. Msiexec.exe can also execute…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
10 Sigma rules tagged T1218.007MsiexecT1218.00710 general rules
- Obfuscated PowerShell MSI Install via WindowsInstaller COMhighexperimental
- DllUnregisterServer Function Call Via Msiexec.EXEmediumtest
- MSI Installation From Webmediumtest
- Msiexec Quiet Installationmediumtest
- MsiExec Web Installmediumtest
- PowerShell WMI Win32_Product Install MSImediumtest
- Suspicious MsiExec Embedding Parentmediumtest
- Suspicious Msiexec Execute Arbitrary DLLmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Msiexec
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.