msiexec.exe Outbound Network C2 via Port 80/443 (T1218.007)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•2

Detects outbound network connections initiated by the Windows Installer utility (msiexec.exe) to non-private (external) IP addresses over standard web ports (80/443). Msiexec.exe can be abused to download and execute malicious payloads or packages from remote locations.