Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
306 detections
Filters
Last updated
All Time
Detection languages
142
85
23
18
14
Contributors
73
46
31
30
20
Categories
252
133
60
47
37
Platforms
304
1
1
1
1
Products / Services
116
93
59
20
8
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
2
1
1
1
1
IDS Classtypes
3
IDS Protocols
3
Detects the presence of the msaRAT MSI dropper (update_ms.msi) and its associated embedded payload (lib.dll), identified by the 'RUN' export and specific msa* string bindings used for inter-process communication or internal functionality.
Detects execution of msiexec.exe involving specific command-line arguments (CA_Run_EA2AEBC3, Bin_lib_EA2AEBC3) often associated with malicious installers or library side-loading, correlated with the loading of 'lib.dll' by the msiexec process.
Detects msiexec.exe launched with /qn or /quiet by powershell.exe or cmd.exe to install an MSI package from a non-standard location, consistent with SMOKE#SCREEN techniques that silently install ScreenConnect via VBScript/WMI droppers and PowerShell downloaders.
Detects a silent MSI installation (msiexec.exe with /i, /quiet, and /qn) where the target MSI file was created or written by the same causality chain on the same host within the preceding 60 minutes, consistent with CountLoader/DOUBLECUP payload staging and silent deployment behavior.
Detects the execution of msiexec.exe to install ScreenConnect.ClientSetup.msi when initiated from user-controlled directories like Downloads or Temp folders. This behavior is indicative of potential social engineering or phishing attacks leveraging legitimate remote access software installers.
Detects PowerShell (or pwsh) processes that both download a file to a temp-like location and subsequently execute or install it within a short time window on the same host, indicative of a staged loader/dropper download-and-execute pattern.
Detects msiexec.exe launched with /qn or /quiet by powershell.exe or cmd.exe to install an MSI package from a non-standard location, consistent with SMOKE#SCREEN techniques that silently install ScreenConnect via VBScript/WMI droppers and PowerShell downloaders.
Detects silent/quiet msiexec.exe installations of ScreenConnect RMM client using suspicious or renamed MSI filenames staged in Temp, AppData\Local\Temp, or Downloads directories, spawned from scripting interpreters, consistent with the SMOKE#SCREEN campaign's abuse of ScreenConnect for persistent access.
Detects a correlated sequence where an unsigned cscript.exe/wscript.exe process executes a .vbs script, WMI-based hidden process creation is observed, and msiexec.exe performs a silent MSI installation, consistent with the SMOKE#SCREEN VBScript dropper chain that uses WMI to silently install a ScreenConnect MSI payload.
Detects a PowerShell-driven sequence where a file is downloaded, has its Mark-of-the-Web removed via Unlock-File, then is executed through msiexec /i on the same file path within a 10-minute window, mirroring the SMOKE#SCREEN ScreenConnect delivery chain.
Detects msiexec.exe executed with silent installation flags (/i /quiet /qn) targeting an MSI file that was written to disk within the preceding 15 minutes, consistent with the CountLoader delivery chain associated with DOUBLECUP.
Detects CountLoader's taskType 6 command performing a silent MSI installation via msiexec.exe /i /quiet /qn, correlated with a PowerShell parent process or a non-standard (temp/AppData/ProgramData) install source path.
Detects silent/quiet msiexec.exe installations of ScreenConnect RMM client using suspicious or renamed MSI filenames staged in Temp, AppData\Local\Temp, or Downloads directories, spawned from scripting interpreters, consistent with the SMOKE#SCREEN campaign's abuse of ScreenConnect for persistent access.
Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.
Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)
Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)
Detects msiexec.exe installing Claude.msi or GolddTV.msi (which use VBScript custom actions to drop the TriBack Loader triad into the Startup folder) or the associated desktop shortcut created under ProgramFiles\SquirrelTemp pointing to the staging VBScript.
Detects msiexec.exe installing Claude.msi or GolddTV.msi (which use VBScript custom actions to drop the TriBack Loader triad into the Startup folder) or the associated desktop shortcut created under ProgramFiles\SquirrelTemp pointing to the staging VBScript.
Detects msiexec.exe installing Claude.msi or GolddTV.msi (which use VBScript custom actions to drop the TriBack Loader triad into the Startup folder) or the associated desktop shortcut created under ProgramFiles\SquirrelTemp pointing to the staging VBScript.
Detects the specific msaRAT-associated MSI custom action chain where the Bin_lib_EA2AEBC3 embedded binary is extracted and loaded as lib.dll by msiexec.exe, invoked by the CA_Run_EA2AEBC3 custom action calling the DLL's RUN export. Scoped to this named-identifier pattern rather than any generic msiexec-loads-embedded-DLL behavior to reduce false positives from legitimate MSI packages that use custom action DLLs.
Detects the Windows Installer (msiexec.exe) launching a command script named poc.cmd, executing with SYSTEM privileges. This pattern is commonly used to proxy execution of malicious scripts or payloads.
Detects the loading of 'lib.dll' by the 'msiexec.exe' process. This behavior is atypical and may indicate DLL hijacking or sideloading where a malicious library is loaded by the Windows Installer process.
Detects the execution of msiexec.exe with the 'ERROROUT=1' flag, which is commonly used to suppress error dialogs during package installation or, more suspiciously, to hide malicious activities or errors when proxies are executing payloads.
Page 6 of 15