Potential MsiExec Masquerading from Uncommon Directory

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects the execution of msiexec.exe from an uncommon directory, which can indicate an attempt to masquerade malicious activity by naming a malicious executable 'msiexec.exe' and placing it outside of its standard legitimate paths. This technique is often used for defense evasion.