Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
306 detections
Filters
Last updated
All Time
Detection languages
142
85
23
18
14
Contributors
73
46
31
30
20
Categories
252
133
60
47
37
Platforms
304
1
1
1
1
Products / Services
116
93
59
20
8
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
2
1
1
1
1
IDS Classtypes
3
IDS Protocols
3
Detects anomalous behavior associated with msiexec.exe that aligns with activity patterns of infostealer malwares like Lumma Stealer and Amadey Bot. This includes cross-process injection from unsigned processes, spawning of msiexec.exe by LOLBins or script interpreters, suspicious outbound network connectivity, and unauthorized access to browser credential storage files.
Detects suspicious process injection attempts where common scripting/execution binaries (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are observed creating remote threads in other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe). The detection is further refined by looking for specific keywords in the initiating process's command line that are indicative of malicious activity, such as downloading content or executing scripts. This rule aims to identify advanced persistent threats and malware leveraging process injection for defense evasion and privilege escalation.
Detects various post-exploitation activities associated with the Amadey loader, including the execution of its persistence mechanism (nudwee.exe), dropping and executing secondary payloads in temporary directories, using PowerShell download cradles, creating scheduled tasks for persistence, and silent MSI installations. This rule aims to identify the delivery of secondary payloads like StealC and Lumma Stealer.
Detects STOCKSTAY malware masquerading as an ILSpy installer using malicious MSI files (Copia.msi, DiplomacyEduAI.msi). The rule identifies the execution of a decoy lure URL through a custom OpenUrl MSI action that triggers the spawning of viewer.exe, as well as file activity associated with the installation path '%LOCALAPPDATA%/Programs/SMN/'.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
This rule detects the use of the 'msiexec.exe' utility to fetch and potentially execute an '.msi' installer package directly from a remote source via HTTP. This behavior is a known technique for bypassing application control by abusing a signed system binary to download and install malicious packages.
This rule detects potentially malicious use of the Windows Installer binary (msiexec.exe) by monitoring for command-line arguments involving remote network resources (HTTP/HTTPS/UNC paths) or suspicious local directories (Temp, AppData, Downloads). Such patterns are indicative of living-off-the-land techniques used to proxy execution, download and install payloads, or perform silent/unauthorized software installations.
Detects suspicious child processes spawned in a suspended state, indicative of process hollowing. The rule specifically targets legitimate Windows system processes (svchost.exe, explorer.exe, rundll32.exe, dllhost.exe, taskhost.exe, taskhostw.exe, msiexec.exe, regsvr32.exe) when they are spawned by non-system parent processes originating from user-writable paths like AppData, Temp, Roaming, ProgramData, or Desktop. This behavior is commonly associated with malware like Remcos RAT.
This rule detects instances where 'msiexec.exe' spawns 'cmd.exe' to execute a batch or command file (.bat or .cmd) located within the 'AppData\Roaming' directory. This behavior can be indicative of malicious activity, as adversaries often use msiexec.exe for proxy execution and drop malicious scripts in user-writable directories like AppData.
This rule detects instances where msiexec.exe, a legitimate Windows Installer utility, spawns discovery tools like wmic.exe or tasklist.exe. This behavior can be indicative of an adversary using msiexec.exe for proxy execution to gather system information, potentially bypassing security controls. The detection looks for wmic.exe or tasklist.exe being launched within a 2-minute window of msiexec.exe, with specific command-line arguments often used for process or system listing, and where msiexec.exe or cmd.exe is the initiating process or parent process.
Detects the execution chain where msiexec.exe spawns rundll32.exe, a pattern observed in LegionLoader to proxy malicious DLL execution. The rule monitors for rundll32.exe command lines referencing common user-writable or staging directories such as AppData, Temp, or ProgramData, which are often used to host malicious payloads, while excluding known legitimate DLLs.
This rule detects potentially malicious activity where msiexec.exe is used to drop payloads or cmd.exe is used to execute batch scripts located within the user's AppData Roaming directory. This pattern is commonly associated with malware staging and execution, including specific indicators linked to LegionLoader.
Detects the execution of 'msiexec.exe' where the installer package is located in suspicious or user-writable directories such as AppData, Temp, or Downloads. It specifically targets MSI files that do not follow standard naming conventions or use suspicious filename patterns, which is a common indicator of dropper or delivery behavior by adversaries.
Detects the execution of msiexec.exe where the command line points to a remote resource via HTTP, HTTPS, or a UNC path. This behavior is indicative of an adversary using msiexec to download and execute a malicious MSI package, leveraging it as a proxy for malicious code execution.
Detects the execution of msiexec.exe or batch files from the AppData Roaming directory, as well as msiexec.exe spawning cmd.exe. These behaviors are frequently associated with staging and executing malicious payloads in user-writable directories.
Detects instances where msiexec.exe spawns suspicious child processes such as cmd.exe, powershell.exe, wscript.exe, or other common LOLBins, often associated with LegionLoader activity. The rule looks for suspicious command-line arguments (e.g., silent install flags, AppData paths, or specific artifacts like xupdate.bat or data.dat) indicative of malicious MSI-based proxy execution.
Detects msiexec.exe being launched with installation flags (/i, /quiet, /q) from user-writable directories (AppData, Temp, Downloads), correlated with file creation in AppData\Roaming subdirectories. This pattern is characteristic of the LegionLoader malware, which drops and executes MSI installer packages to facilitate further infection stages.
Detects a suspicious execution chain associated with LegionLoader, where msiexec.exe is observed spawning cmd.exe to execute batch scripts located in temporary directories such as AppData\Roaming or system temp folders. This rule correlates an initial msiexec process initiation with a subsequent suspicious child process creation event on the same host.
Detects the LegionLoader malware using a malicious normaliz.dll staged in user-writable directories (AppData\Roaming\Traiolx Custom Utils) to perform DLL sideloading. The rule correlates this malicious module load with suspicious LOLBin behavior where msiexec.exe executes cmd.exe, forming a known infection chain.
Detects the LegionLoader malware execution chain, specifically identifying the side-loading of a malicious 7z.dll file placed in user-writable directories (e.g., AppData, Temp) instead of legitimate 7-Zip installation paths. This rule correlates the file creation event with the suspicious behavior of msiexec.exe launching cmd.exe, a characteristic pattern of the LegionLoader LOLBin execution flow.
Detects a multi-stage activity chain associated with BumbleBee malware. The rule correlates the execution of an MSI installer from user-writable directories (e.g., Downloads, Temp) with the creation of a 'msimg32.dll' file in a non-System32 directory, followed by the loading of this suspicious DLL into the 'consent.exe' process. This pattern is characteristic of BumbleBee's DLL sideloading execution technique.
Page 9 of 15