Analytics BIOC
Informational
✕
Msiexec execution of an executable from an uncommon remote location
Msiexec is the command-line utility for the Windows Installer. Adversaries may abuse msiexec.exe to proxy execution of malicious payloads from remote locations.
- Module:
- Platform Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: System Binary Proxy Execution: Msiexec (T1218.007)
Detector tags: LOLBIN Execution Analytics
Attacker's goals:
Evading security controls and executing arbitrary files from the web.
Investigative actions:
Monitor the command-line arguments of msiexec.exe, For example, the command line - msiexec /i http://some_domain.com/www/executable.msi can be legitimate or malicious. Validate the following criteria, if none of them are correct, follow incident response procedures: Check execution of msiexec and the IP/Domain that used. Is the URL that is encoded in the command line trusted. Is executed DLL or MSI file known as legitimate. Is the initiating process legitimate and the user running it knows of its use.
- Test period:
- N/A (single event)
- Deduplication:
- 7 Days
2 variations:
- Msiexec execution of an executable from an uncommon remote location with a specific port High (parent: Informational)
- Msiexec execution of an executable from an uncommon remote location without properties Medium (parent: Informational)