Config.Msi folder recreated by non-SYSTEM process with permissive DACL (CVE-2025-27727)

Emiliano Mema@Nosalva

•updated Jul 22, 2026•0•0•3

This rule detects the creation of the 'C:\Config.Msi' folder or files within it that have weak security descriptors (SDDL). This folder is frequently used by the Windows Installer service, and if insecure permissions are applied, an attacker can perform privilege escalation or perform DLL hijacking by placing malicious files within this directory.