Detect Msiexec in Google Chronicle
Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is commonly associated with executing installation packages (.msi). Since it is a signed Microsoft binary, msiexec.exe can bypass application control solutions. Adversaries use it to launch local or remote MSI files and to execute DLLs. Execution may also be elevated to SYSTEM if the AlwaysInstallElevated policy is enabled. Widely abused by malware families including QakBot, IcedID, Emotet, Clop, Maze, Ragnar Locker, Latrodectus, Raspberry Robin, TA505, Rancor, ZIRCONIUM, and many others.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1218 System Binary Proxy Execution
- Sub-technique
- T1218.007 Msiexec
- Canonical reference
- https://attack.mitre.org/techniques/T1218/007/
YARA-L Detection Query
rule t1218_007_msiexec_proxy_execution {
meta:
author = "Detection Engineering"
description = "Detects msiexec.exe abuse for proxy execution of malicious payloads via remote MSI loading, DLL registration, silent install from suspicious paths, or suspicious parent processes. MITRE ATT&CK T1218.007 - Defense Evasion."
mitre_attack_tactic = "Defense Evasion"
mitre_attack_technique = "T1218.007"
mitre_attack_technique_name = "System Binary Proxy Execution: Msiexec"
severity = "HIGH"
confidence = "HIGH"
platforms = "Windows"
false_positives = "SCCM deployments, patch management tools, IT automation scripts"
events:
$e.metadata.event_type = "PROCESS_LAUNCH"
$e.target.process.file.full_path = /(?i)\\msiexec\.exe$/ nocase
(
re.regex($e.target.process.command_line, `(?i)(http[s]?|ftp)://`) or
re.regex($e.target.process.command_line, `(?i)\s/y\s`) or
(
re.regex($e.target.process.command_line, `(?i)(/q\s|/quiet\s|/passive\s)`) and
re.regex($e.target.process.command_line, `(?i)(temp|appdata|downloads|public|desktop)`)
) or
re.regex($e.principal.process.file.full_path, `(?i)(cmd|powershell|wscript|cscript|mshta|winword|excel|outlook)\.exe$`)
)
condition:
$e
}Chronicle YARA-L 2.0 rule detecting T1218.007 msiexec.exe proxy execution abuse using UDM event model. Matches PROCESS_LAUNCH events where the target is msiexec.exe and at least one of four suspicious indicators is present: remote URL in command line, DLL registration flag /y, silent install combined with suspicious staging path, or execution from an Office or scripting engine parent process. Covers known abuse by QakBot, IcedID, Emotet, Clop, and Latrodectus.
Data Sources
Required Tables
False Positives & Tuning
- Enterprise software deployment tools (SCCM, Intune, Altiris) executing msiexec silently from AppData or Temp staging directories as part of policy-driven software pushes
- Vulnerability management agents (Qualys, Tenable) that install update packages via msiexec with /quiet from their own AppData working directories
- Legitimate macro-enabled Office documents used by finance or HR teams that invoke msiexec as part of sanctioned document-driven workflows, triggering the Office parent process indicator
Other platforms for T1218.007
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Msiexec Remote MSI Execution
Expected signal: Sysmon Event ID 1: msiexec.exe with URL and /q flag. Sysmon Event ID 3: Network connection attempt to 127.0.0.1:8080. Security Event ID 4688. The installation will fail (no server) but the process creation event fires.
- Test 2Msiexec DLL Execution via /y Flag
Expected signal: Sysmon Event ID 11: DLL written to Temp. Sysmon Event ID 1: msiexec.exe with /y flag and Temp path. Sysmon Event ID 7 (Image Load) for the DLL being loaded by msiexec.
- Test 3Msiexec Silent Install from Temp Directory via PowerShell
Expected signal: Sysmon Event ID 1: powershell.exe, then msiexec.exe with /q and Temp path, ParentImage=powershell.exe. Both SuspiciousParent and SuspiciousPath fire. Security Event ID 4688 for both.
References (6)
- https://attack.mitre.org/techniques/T1218/007/
- https://lolbas-project.github.io/lolbas/Binaries/Msiexec/
- https://blog.trendmicro.com/trendlabs-security-intelligence/attack-using-windows-installer-msiexec-exe-leads-lokibot/
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec
- https://docs.microsoft.com/en-us/windows/win32/msi/alwaysinstallelevated
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
Unlock Pro Content
Get the full detection package for T1218.007 including response playbook, investigation guide, and atomic red team tests.