Suspicious Msiexec Quiet Install From Remote Location
Detects the usage of msiexec.exe to perform a quiet installation of a package from a remote location (either HTTP/HTTPS or a UNC path). This behavior is often associated with malware distribution, including the Raspberry Robin worm, to evade detection and establish persistence.
Sigma
