msiexec.exe remote MSI install as ClickFix stage-2 loader
Detects usage of msiexec.exe to execute an MSI package from a remote URL. This technique is often used to download and execute malicious installers directly from the internet, bypassing local file storage.
Microsoft Sentinel (KQL)
