msiexec.exe spawns SYSTEM child process poc.cmd during rollback (CVE-2025-27727)

Emiliano Mema@Nosalva

•updated Jul 22, 2026•0•0•6

Detects the Windows Installer (msiexec.exe) launching a command script named poc.cmd, executing with SYSTEM privileges. This pattern is commonly used to proxy execution of malicious scripts or payloads.