Detect Installer Packages in Google Chronicle

rule T1546_016_installer_package_persistence {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects installer packages (msiexec, dpkg, rpm, pkgutil, apt, chocolatey, winget) spawning script interpreters or executing download cradle commands — T1546.016 Installer Package Persistence and Privilege Escalation"
    mitre_attack_technique = "T1546.016"
    mitre_attack_tactic = "Persistence, Privilege Escalation"
    severity = "HIGH"
    confidence = "MEDIUM"
    created = "2026-04-20"
    reference = "https://attack.mitre.org/techniques/T1546/016/"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    re.regex(
      $e.principal.process.file.full_path,
      `(?i)(msiexec\.exe|/installer|pkgutil|/dpkg|/rpm|/yum|apt-get|/apt\b|chocolatey|winget)`
    )
    (
      re.regex(
        $e.target.process.file.full_path,
        `(?i)(powershell\.exe|pwsh\.exe|cmd\.exe|wscript\.exe|cscript\.exe|mshta\.exe|certutil\.exe|bitsadmin\.exe|/bash|/sh$|python3?$)`
      )
      or
      re.regex(
        $e.target.process.command_line,
        `(?i)(invoke-webrequest|downloadstring|net\.webclient|-encodedcommand|certutil.{0,20}urlcache|bitsadmin.{0,20}transfer|curl.{0,30}https?://|wget.{0,30}https?://)`
      )
    )
    $hostname = $e.principal.hostname

  condition:
    $e
}