GRIMWEDGE backdoor command execution via msiexec.exe child processes

Arnold Chan@slaz

•updated 29 days ago•0•0•1

Detects msiexec.exe executing from the Temp directory with suspicious command-line arguments (such as hidden windows) and spawning child processes like cmd.exe, tasklist.exe, or taskkill.exe. This behavior is often indicative of malicious installation scripts attempting to perform discovery or terminate security processes while remaining stealthy.