msaRAT MSI Custom Action CA_Run_EA2AEBC3 Loads lib.dll
Detects execution of a specific msaRAT MSI custom action that loads an embedded lib.dll payload from the MSI Binary table into memory via msiexec.exe during the InstallFinalize phase.
Sigma
Detects execution of a specific msaRAT MSI custom action that loads an embedded lib.dll payload from the MSI Binary table into memory via msiexec.exe during the InstallFinalize phase.
Already have an account?