Silent MSI Install via PowerShell/cmd Spawning msiexec /qn or /quiet (Non-Standard Source)
Detects msiexec.exe launched with /qn or /quiet by powershell.exe or cmd.exe to install an MSI package from a non-standard location, consistent with SMOKE#SCREEN techniques that silently install ScreenConnect via VBScript/WMI droppers and PowerShell downloaders.
Cortex XDR
