PowerShell-spawned msiexec installs GUID MSI launching signed app from fake Prog

Ibrahim Saud@tektrix

•updated Sep 29, 2026•1•0•1

Detects a suspicious behavior pattern where PowerShell initiates an 'msiexec.exe' process to install an MSI file located in a temporary directory, followed by that MSI process launching a secondary executable from a '%LOCALAPPDATA%\Programs\' folder. This pattern is commonly associated with malware installation or post-exploitation activities where an attacker attempts to masquerade an executable as a legitimate program.