Most Popular LOLBIN 2026: Msiexec Remote MSI Package Installation from Web Path
Detects msiexec.exe execution with flags intended for silent or standard installation when the source path points to a remote web resource (HTTP/HTTPS) or a UNC path. This behavior is indicative of using the native Windows Installer to proxy the download and execution of arbitrary, potentially malicious, MSI packages.
Sigma
