Suspicious Msiexec /i Installation from Remote HTTP(S) Domain (Non-Private IP)

Marcus Mingo@meeengoh

•updated Feb 18, 2026•6•2•92

Detects msiexec.exe executing with /i to install an MSI package from a remote HTTP/HTTPS domain, excluding internal RFC1918 networks, loopback, and APIPA addresses. This pattern is commonly used for remote payload installation and malware staging over the web.