Seedworm update_ms.msi Execution
Detects the specific Seedworm MSI dropper 'update_ms.msi' executed via msiexec. This rule identifies process execution where 'msiexec.exe' is the process and its command line contains 'update_ms.msi', indicating the execution of a known malicious MSI file associated with the Seedworm APT group.
Microsoft Sentinel (KQL)
