Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
306 detections
Filters
Last updated
All Time
Detection languages
142
85
23
18
14
Contributors
73
46
31
30
20
Categories
252
133
60
47
37
Platforms
304
1
1
1
1
Products / Services
116
93
59
20
8
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
2
1
1
1
1
IDS Classtypes
3
IDS Protocols
3
Detects Windows Installer executing an MSI package from ProgramData, matching the msaRAT delivery chain in which update_ms.msi is downloaded to that directory and then executed.
Detects the loading of a malicious DLL into the msiexec.exe process that exhibits characteristic Rust/Tokio async-runtime initialization behavior. This includes exported function names like 'RUN' and specific interactions with the 'TOKIO_WORKER_THREADS' environment variable or API calls to 'GetSystemInfo' and 'CreateThread' to size the worker thread pool. This behavior is associated with msaRAT, where the DLL is loaded via MSI custom actions to run within the context of the Windows Installer service.
Detects the specific msaRAT-associated MSI custom action chain where the Bin_lib_EA2AEBC3 embedded binary is extracted and loaded as lib.dll by msiexec.exe, invoked by the CA_Run_EA2AEBC3 custom action calling the DLL's RUN export. Scoped to this named-identifier pattern rather than any generic msiexec-loads-embedded-DLL behavior to reduce false positives from legitimate MSI packages that use custom action DLLs.
Detects the specific msaRAT-associated MSI custom action chain where the Bin_lib_EA2AEBC3 embedded binary is extracted and loaded as lib.dll by msiexec.exe, invoked by the CA_Run_EA2AEBC3 custom action calling the DLL's RUN export. Scoped to this named-identifier pattern rather than any generic msiexec-loads-embedded-DLL behavior to reduce false positives from legitimate MSI packages that use custom action DLLs.
Detects a suspicious sequence of events where a non-standard process writes to the Windows Installer TempPackages registry key, followed by the msiexec.exe process running as SYSTEM deleting the C:\Config.Msi folder. This behavior is indicative of potential privilege escalation or exploitation, such as CVE-2025-27727, where an attacker leverages msiexec's high-privilege context to perform unauthorized file operations.
Detects the download and execution of the malicious v7.msi installer from the domain camorreado.click. This file acts as a loader for the EtherRAT Node.js RAT, often delivered in the context of fake IT support phishing campaigns. The rule monitors both network connection events to the malicious domain and process creation events involving msiexec.exe execution of the specific MSI payload.
Correlates multiple suspicious behavioral patterns characteristic of the 'ClickFix' attack chain. The rule detects techniques such as PowerShell execution via RunMRU or Windows Terminal, CAPTCHA-lure download cradles, hidden-window PowerShell execution, fileless AES/TripleDES runspace payloads, COM hijacking, and suspicious LOLBin usage. The detection logic uses a 1-hour sliding window to aggregate these patterns on a per-device basis, assigning a higher confidence score as more stages of the attack chain are observed.
Detects the execution of msiexec.exe with silent (/Q) and system component (ARPSYSTEMCOMPONENT=1) flags, initiated by explorer.exe. These flags are often used to install MSI packages invisibly, potentially by malicious actors to perform background installations without user interaction.
Detects instances where the msiexec.exe process, running under the local system account (S-1-5-18), deletes files located within the 'C:\Config\.Msi' directory. This behavior is often associated with the misuse of the Windows Installer service or exploitation techniques intended to leverage system-level file operations for privilege escalation or persistence.
Detects the execution of a malicious MSI installer masquerading as a legitimate Microsoft FIXMAPI utility. The rule flags suspicious MSI command lines or the presence of the AICustAct.dll component (associated with Advanced Installer) within paths containing the misspelled publisher 'Microsoft Coporation' or the 'Microsoft FIXMAPI' utility string.
Detects the execution of known Living-off-the-Land Binaries (LOLBins) such as certutil.exe, msiexec.exe, regsvcs.exe, and regasm.exe when their command line contains suspicious keywords like 'download', 'http', or 'encode'. This activity can indicate an attempt to download malicious payloads or bypass security controls.
Detects a suspicious execution chain associated with LegionLoader where msiexec.exe triggers cmd.exe, which subsequently invokes 7-Zip (7z.exe or 7za.exe) to extract payloads into the AppData\Roaming directory. This pattern is characteristic of LegionLoader's staging phase.
Detects the abuse of msiexec.exe to execute malicious payloads, a technique observed in the StrikeShark campaign. The rule identifies suspicious child processes, installation from remote sources (UNC/HTTP), execution from non-standard user-writable directories (Temp, AppData), and the use of quiet installation flags to mask malicious activity.
This rule detects potentially malicious use of the Windows Installer binary (msiexec.exe) by monitoring for command-line arguments involving remote network resources (HTTP/HTTPS/UNC paths) or suspicious local directories (Temp, AppData, Downloads). Such patterns are indicative of living-off-the-land techniques used to proxy execution, download and install payloads, or perform silent/unauthorized software installations.
Detects instances where the Windows Installer (msiexec.exe) spawns a command prompt (cmd.exe) to execute specific batch files or custom scripts, which is a technique often used for malicious proxy execution.
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
Detects the abuse of msiexec.exe to perform suspicious actions such as fetching payloads from remote URLs, UNC paths, or loading from user-writable directories (e.g., AppData, Temp, ProgramData). The rule further correlates this with msiexec spawning suspicious child processes (e.g., cmd.exe, powershell.exe, wscript.exe), which is indicative of malicious post-exploitation activity.
Detects LegionLoader-like behavior where msiexec.exe creates a temporary MSI file in the system temp directory and subsequently executes it using the msiexec command line utility, a pattern often used to proxy malicious payload execution while evading detection.
Detects the use of msiexec.exe to execute installation commands specifically involving Visual C++ Redistributable DLLs (vcredist_x64.dll or vcredist_x86.dll) with quiet installation flags. This behavior may indicate an attempt to bundle or install dependencies via msiexec to proxy execution.
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
This rule detects the use of the 'msiexec.exe' utility to fetch and potentially execute an '.msi' installer package directly from a remote source via HTTP. This behavior is a known technique for bypassing application control by abusing a signed system binary to download and install malicious packages.
Page 7 of 15