Msiexec installing MSI package downloaded from Azure Blob Storage

Emiliano Mema@Nosalva

•updated Aug 25, 2026•12•0•9

Detects the execution of the Windows Installer utility (msiexec.exe) where the command line references an Azure Blob Storage URL. This pattern is commonly used by adversaries to download and install malicious MSI packages directly from a remote storage location, bypassing local file creation.