Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
306 detections
Filters
Last updated
All Time
Detection languages
142
85
23
18
14
Contributors
73
46
31
30
20
Categories
252
133
60
47
37
Platforms
304
1
1
1
1
Products / Services
116
93
59
20
8
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
2
1
1
1
1
IDS Classtypes
3
IDS Protocols
3
Detects msiexec.exe executing with /i to install an MSI package from a remote HTTP/HTTPS domain, excluding internal RFC1918 networks, loopback, and APIPA addresses. This pattern is commonly used for remote payload installation and malware staging over the web.
Detects the use of msiexec.exe to install a package from a remote URL that contains keywords associated with fake verification or captcha lures. This technique is used by threat actors in "Fake Captcha" campaigns to bypass script-based detections.
Detects the execution of msiexec.exe to install an MSI package with a naming convention characteristic of the GS7 threat actor. GS7 uses specific, automated naming conventions for their malicious RMM installers, such as 'em_[8 alphanumeric]_installer' or 'Win_[18-20 digits]_installer'.
This rule detects suspicious outbound network connections to Cloudflare Workers domains, indicative of potential command and control (C2) activity. It identifies connections to known malicious Cloudflare Workers domains or IPs, as well as generic Cloudflare Workers domains (.workers.dev) when initiated by suspicious processes like `WsusService.exe`, `curl.exe`, `certutil.exe`, `bitsadmin.exe`, `Velociraptor.exe`, or `msiexec.exe`. The rule prioritizes detection based on specific indicators like known malicious workers or C2 IPs, and flags activity from processes commonly abused for C2 or payload delivery. It also provides severity scoring and investigation steps based on the identified threat type.
This rule detects suspicious child processes spawned by 'WsusService.exe', which is indicative of successful exploitation of a vulnerability like CVE-2025-59287. The rule specifically looks for the WSUS service initiating common command-line utilities such as cmd.exe, powershell.exe, curl.exe, wget.exe, certutil.exe, bitsadmin.exe, and msiexec.exe, which are often used for post-exploitation activities like command execution, downloading additional payloads, or system manipulation. The severity is dynamically assigned based on the spawned process, with download utilities like curl.exe, certutil.exe, and bitsadmin.exe being flagged as 'Critical'.
This rule detects the execution of msiexec.exe from cmd.exe with command-line arguments indicating a silent installation of a remote MSI package over HTTP or HTTPS. This behavior is indicative of post-exploitation activity, specifically observed in the context of SolarWinds Web Help Desk (WHD) exploitation where attackers use msiexec to download and install malicious payloads.
Detects when a Remote Monitoring and Management (RMM) tool or a known lure spawns 'msiexec.exe' to download and execute a remote installer. This behavior is often abused by threat actors to deploy secondary payloads like additional C2 tools, leveraging legitimate RMM functionality.
Detects when a known Remote Monitoring and Management (RMM) tool is used to install a secondary RMM tool. Threat actors use this technique to establish redundant and persistent access to victim networks.
Detects ScreenConnect/ConnectWise Control malware installer MSI and components
Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.
Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)
Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)
Detects the use of msiexec.exe to remotely download and execute an MSI package, which then spawns an encoded PowerShell command. This TTP is associated with NetSupport RAT loaders.
Detects instances where the Windows Installer service (msiexec.exe) spawns command-line interpreters like cmd.exe or PowerShell.exe. This behavior is often associated with the 'AlwaysInstallElevated' policy being enabled, which can lead to privilege escalation.
Detects the Windows Installer service (msiexec.exe) attempting to install MSI packages with SYSTEM privileges, which can be indicative of privilege escalation through the 'AlwaysInstallElevated' policy.
The following analytic detects MSIExec making network connections over ports 443 or 80. This behavior is identified by correlating process creation events from Endpoint Detection and Response (EDR) agents with network traffic logs. Typically, MSIExec does not perform network communication to the internet, making this activity unusual and potentially indicative of malicious behavior. If confirmed malicious, an attacker could be using MSIExec to download or communicate with external servers, potentially leading to data exfiltration, command and control (C2) communication, or further malware deployment.
Detects the usage of msiexec.exe to perform a quiet installation of a package from a remote location (either HTTP/HTTPS or a UNC path). This behavior is often associated with malware distribution, including the Raspberry Robin worm, to evade detection and establish persistence.
Detects the creation of suspicious child processes, such as common scripting or living-off-the-land binaries (LOLBINs), originating from applications located within the WindowsApps directory. This activity could indicate the execution of malicious '.appx' packages or other forms of code execution from an unexpected and potentially untrusted source.
The analytic detects the use of msiexec.exe with an HTTP or HTTPS URL in the command line, indicating a remote file download attempt. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant as it may indicate an attempt to download and execute potentially malicious software from a remote server. If confirmed malicious, this could lead to unauthorized code execution, system compromise, or further malware deployment within the network.
Detects hard IoCs and activity associated with a trojanized installer of Velociraptor incident response tool making callbacks to C2 domains from workers[.]dev and tunneling with Visual Studio Code (code.exe). The detection looks for the creation of hard IoCs from this malicious Velociraptor installer V2.msi, followed by network connections to known C2 domains and the execution of related processes, including PowerShell (with support for detecting encoded commands to install code.exe) and msiexec activity tied to malicious domains.
Detects the execution of LOLBins (msiexec.exe, mshta.exe) with command-line arguments to download or execute remote files, a technique used in the ShadowCaptcha campaign's initial access phase via fake CAPTCHA pages.
Detects the initial execution of the Raspberry Robin malware from an external drive. The rule specifically looks for `cmd.exe` as a parent process, executing a command containing `/r` and ending with specific file extensions (like .bin, .ico, .lnk, .lo, .sv, .usb), which then launches `msiexec.exe` with `/q` and a URL (http: or https:). This pattern is indicative of Raspberry Robin's initial infection vector.
This rule detects the execution of msiexec.exe attempting to load a DLL and call its DllUnregisterServer function. This behavior is often abused by adversaries for defense evasion and proxy execution, as msiexec.exe is a legitimate Windows utility. The detection specifically looks for msiexec.exe being executed with the '-z' flag and a command line containing '.dll', indicating an attempt to unregister a DLL.
Page 12 of 15