RMM Software Installation from an Internet-Originated MSI

  1[metadata]
  2creation_date = "2026/08/07"
  3integration = ["endpoint"]
  4maturity = "production"
  5min_stack_comments = "FROM subquery support became generally available in 9.5.0"
  6min_stack_version = "9.5.0"
  7updated_date = "2026/09/18"
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Identifies a Windows Installer package (MSI) originating from the internet, which when executed, installs a recognized
 13RMM product. Attackers use RMMs commonly in social engineering campaigns to gain access and control over the victim's
 14system. This rule does not establish that the origin, installer, or RMM product is inherently malicious. It also
 15excludes installations covered by the companion rule "RMM Software Installation from a Commonly Abused Web Service".
 16"""
 17false_positives = [
 18    """
 19    Authorized IT or managed service provider deployment of remote monitoring and management software through vendor,
 20    internal, or other software distribution infrastructure can produce this behavior.
 21    """,
 22]
 23from = "now-25m"
 24interval = "5m"
 25language = "esql"
 26license = "Elastic License v2"
 27name = "RMM Software Installation from an Internet-Originated MSI"
 28note = """ ## Triage and analysis
 29
 30> **Disclaimer**:
 31> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 32
 33### Investigating RMM Software Installation from an Internet-Originated MSI
 34
 35This rule detects when a recently downloaded MSI runs through Windows Installer and creates a recognized remote monitoring or management executable, a sequence that can establish persistent remote control. An attacker may use a phishing lure or fake support interaction to convince a Windows user to install the package, then operate the resulting remote-access agent for command execution, surveillance, or additional payload delivery.
 36
 37### Possible investigation steps
 38
 39- Assess the download URL, referrer, domain age and reputation, and surrounding proxy or browser activity to determine how the user obtained the installer.
 40- Validate the MSI hash, digital signature, certificate chain, product metadata, and expected vendor distribution channel, and compare them with approved software inventory and threat intelligence.
 41- Reconstruct the user and process timeline around the download and execution, including email or chat lures, browser activity, support interactions, and whether IT authorized the installation.
 42- Examine installer logs and subsequent host changes for new services, scheduled tasks, startup entries, RMM configuration or tenant identifiers, unattended-access settings, and suspicious child processes.
 43- Review post-install network connections and RMM session activity for remote commands, file transfers, credential access, or additional payloads, then scope matching hashes, domains, and agent identifiers across the environment and isolate unauthorized systems.
 44
 45### False positive analysis
 46
 47- Authorized IT staff may install an approved RMM agent from its official internet distribution site, so confirm the source domain, MSI signature and hash, target host, and associated change record.
 48- A user may install an RMM package during a legitimate support session, so verify the support request, user confirmation, expected executable, and whether unattended access was authorized.
 49
 50### Response and remediation
 51
 52- Isolate affected systems from the network, terminate active RMM sessions and processes, and block the MSI hash, source domain, download URL, and identified RMM infrastructure.
 53- Uninstall the unauthorized RMM agent and remove its services, scheduled tasks, startup entries, unattended-access configuration, dropped executables, installer cache, and downloaded MSI.
 54- Escalate immediately to incident response if the RMM agent established a remote session, executed commands, transferred files, accessed credentials, installed additional payloads, or appears on multiple systems.
 55- Reset credentials and revoke active sessions for affected users and privileged accounts used on the host, then review adjacent systems for reuse of the MSI hash, RMM executable, tenant identifier, or source domain.
 56- Reimage systems from a known-good baseline when integrity cannot be established, restore validated data, patch the operating system and applications, and verify that no unauthorized RMM connectivity or persistence remains.
 57- Prevent recurrence by allowlisting approved RMM products and tenant identifiers, restricting MSI execution and software installation to managed deployment channels, applying application control, and blocking unapproved remote-access tools and download sources.
 58"""
 59references = [
 60    "https://www.proofpoint.com/us/blog/threat-insight/remote-monitoring-and-management-rmm-tooling-increasingly-attackers-first-choice",
 61    "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-131a",
 62    "https://cloud.google.com/blog/topics/threat-intelligence/seo-poisoning-batloader-atera/",
 63    "https://www.microsoft.com/en-us/security/blog/2026/03/03/signed-malware-impersonating-workplace-apps-deploys-rmm-backdoors/",
 64    "https://www.huntress.com/blog/series-of-unfortunate-rmm-events",
 65]
 66risk_score = 21
 67rule_id = "7dd15e54-0e23-4e99-80e7-6651ef7ce9d5"
 68setup = """## Setup
 69
 70This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
 71
 72Setup instructions: https://ela.st/install-elastic-defend
 73"""
 74severity = "low"
 75tags = [
 76    "Domain: Endpoint",
 77    "OS: Windows",
 78    "Platform: Windows",
 79    "Rule Type: ES|QL",
 80    "Use Case: Threat Detection",
 81    "Tactic: Defense Evasion",
 82    "Tactic: Command and Control",
 83    "Data Source: Elastic Defend",
 84    "Resources: Investigation Guide",
 85]
 86timestamp_override = "event.ingested"
 87type = "esql"
 88
 89query = '''
 90/*
 91Correlate three events on the same host: an internet-originated MSI outside the curated web-service set, the same user
 92running that MSI with msiexec within 10 minutes, and msiexec creating a known RMM executable within 5 more minutes.
 93Keep the MSI download event as the alert.
 94*/
 95FROM
 96(
 97  FROM logs-endpoint.events.file-* METADATA _id, _version, _index
 98    | WHERE KQL("event.action: creation") AND TO_LOWER(file.extension) == "msi" AND file.origin_url IS NOT NULL
 99    | EVAL Esql.sequence_stage = "origin"
100    | URI_PARTS Esql.origin = file.origin_url
101    | EVAL Esql.origin.domain = TO_LOWER(Esql.origin.domain)
102    // Complement the curated tier.
103    | WHERE NOT (
104      // Source code and developer artifact hosting.
105      Esql.origin.domain LIKE (
106        "api.bitbucket.org", "bitbucket.org",
107        "api.github.com", "gist.githubusercontent.com", "github.com",
108        "github-releases.githubusercontent.com", "objects.githubusercontent.com",
109        "raw.githack.com", "raw.githubusercontent.com", "rawcdn.githack.com",
110        "release-assets.githubusercontent.com",
111        "gitlab.com", "*.gitlab.com",
112        "notabug.org",
113        "sourceforge.net", "*.sourceforge.net"
114      ) OR
115      // AWS S3 object storage.
116      Esql.origin.domain LIKE (
117        "s3.amazonaws.com", "*.s3.amazonaws.com",
118        "s3.*.amazonaws.com", "*.s3.*.amazonaws.com",
119        "s3-*.amazonaws.com", "*.s3-*.amazonaws.com",
120        "*.s3express-*.amazonaws.com"
121      ) OR
122      // Azure, Cloudflare R2, Discord, and Dropbox.
123      Esql.origin.domain LIKE (
124        "*.azurewebsites.net", "*.azurestaticapps.net",
125        "*.azurecontainerapps.io",
126        "*.blob.core.windows.net", "*.blob.storage.azure.net",
127        "*.web.core.windows.net", "*.web.storage.azure.net",
128        "*.file.core.windows.net",
129        "*.azurefd.net", "*.azureedge.net",
130        "*.r2.dev",
131        "cdn.discordapp.com",
132        "dropbox.com", "*.dropbox.com",
133        "dropboxusercontent.com", "*.dropboxusercontent.com"
134      ) OR
135      // Firebase Storage, Google Drive, and Cloud Storage.
136      Esql.origin.domain LIKE (
137        "*.googleusercontent.com", "content-storage.googleapis.com",
138        "firebasestorage.googleapis.com",
139        "docs.google.com", "drive.google.com", "drive.usercontent.google.com",
140        "storage-download.googleapis.com", "storage.googleapis.com", "*.storage.googleapis.com",
141        "www.googleapis.com"
142      ) OR
143      // OneDrive, SharePoint, Onehub, OnlyOffice, pCloud, Slack, Supabase, and Wasabi.
144      Esql.origin.domain LIKE (
145        "api.onedrive.com", "files.1drv.com", "*.files.1drv.com",
146        "onedrive.live.com", "*.onedrive.live.com",
147        "sharepoint.com", "*.sharepoint.com",
148        "storage.live.com", "*.storage.live.com",
149        "onehub.com", "*.onehub.com",
150        "onlyoffice.com", "*.onlyoffice.com",
151        "pcloud.com", "*.pcloud.com",
152        "files.slack.com", "slack-files.com",
153        "*.supabase.co",
154        "s3.wasabisys.com", "*.s3.wasabisys.com",
155        "s3.*.wasabisys.com", "*.s3.*.wasabisys.com"
156      ) OR
157      // Developer tunnels, reverse proxies, automation, and webhooks.
158      Esql.origin.domain LIKE (
159        "devtunnels.ms", "*.devtunnels.ms",
160        "localtunnel.me", "*.localtunnel.me",
161        "n8n.cloud", "*.n8n.cloud",
162        "*.ngrok.app", "*.ngrok.dev",
163        "*.ngrok-free.app", "*.ngrok-free.dev",
164        "*.ngrok.io", "*.ngrok.pizza", "*.ngrok.pro",
165        "pagekite.me", "*.pagekite.me",
166        "serveo.net", "*.serveo.net",
167        "trycloudflare.com", "*.trycloudflare.com",
168        "webhook.site"
169      ) OR
170      // File-sharing and transfer services.
171      Esql.origin.domain LIKE (
172        "4shared.com", "*.4shared.com",
173        "*.4sync.com",
174        "bashupload.com", "*.bashupload.com",
175        "catbox.moe", "*.catbox.moe",
176        "easyupload.io", "*.easyupload.io",
177        "file.io",
178        "filebin.net",
179        "filecloud.me",
180        "files.fm", "*.files.fm",
181        "filetransfer.io", "*.filetransfer.io",
182        "gofile.io", "*.gofile.io",
183        "limewire.com", "*.limewire.com",
184        "mediafire.com", "*.mediafire.com",
185        "mega.co.nz", "*.mega.co.nz",
186        "mega.nz", "*.mega.nz",
187        "pixeldrain.com", "*.pixeldrain.com",
188        "send.cm", "*.send.cm", "send.now", "*.send.now",
189        "sendit.sh", "*.sendit.sh",
190        "sendspace.com", "*.sendspace.com",
191        "share.riseup.net",
192        "temp.sh", "tempsend.com",
193        "transfer.sh",
194        "ufile.io", "*.ufile.io",
195        "upload.ee", "*.upload.ee",
196        "we.tl", "wetransfer.com", "*.wetransfer.com", "*.wetransfer.net",
197        "workupload.com"
198      ) OR
199      // CDN, paste, and public hosting services.
200      Esql.origin.domain LIKE (
201        "*.alwaysdata.net",
202        "blogspot.com", "*.blogspot.com",
203        "b-cdn.net", "*.b-cdn.net",
204        "cdnmegafiles.com", "*.cdnmegafiles.com",
205        "infinityfreeapp.com", "*.infinityfreeapp.com",
206        "free.keep.sh",
207        "*.netlify.app",
208        "paste.ee",
209        "publicvm.com", "*.publicvm.com",
210        "*.vercel.app",
211        "*.*.workers.dev"
212      ) OR
213      // Decentralized and content-addressed storage.
214      Esql.origin.domain LIKE (
215        "ar.io", "*.ar.io", "arweave.net", "*.arweave.net",
216        "ic0.app", "*.ic0.app", "icp0.io", "*.icp0.io",
217        "dweb.link", "*.dweb.link",
218        "gateway.pinata.cloud",
219        "ipfs.io", "*.ipfs.io",
220        "mypinata.cloud", "*.mypinata.cloud",
221        "nftstorage.link", "*.nftstorage.link",
222        "storjshare.io", "*.storjshare.io",
223        "web3.storage", "*.web3.storage"
224      )
225    )
226),
227(
228  FROM logs-endpoint.events.process-* METADATA _id, _version, _index
229  | WHERE host.os.type == "windows" AND
230      KQL("event.type: start") AND
231      process.name.caseless == "msiexec.exe"
232  | EVAL Esql.sequence_stage = "execute"
233  | KEEP @timestamp, host.id, process.args, user.id, _id, _version, _index, Esql.sequence_stage
234),
235(
236  FROM logs-endpoint.events.file-* METADATA _id, _version, _index
237  | WHERE KQL("event.action: creation") AND process.name.caseless == "msiexec.exe"
238  | EVAL file.name.caseless = TO_LOWER(file.name)
239  | WHERE
240    file.name.caseless IN (
241      // Acronis
242      "acroniscyberprotectconnectagent.exe",
243
244      // AeroAdmin
245      "aeroadmin.exe",
246
247      // AnyDesk
248      "anydesk.exe",
249
250      // APC
251      "apc_admin.exe",
252      "apc_host.exe",
253
254      // Atera
255      "ateraagent.exe",
256
257      // AweSun
258      "awesun.exe",
259
260      // BarracudaRMM
261      "cagservice.exe",
262
263      // BeyondTrust
264      "b4-service.exe",
265      "basupsrvc.exe",
266      "bomgar-scc.exe",
267      "remote support.exe",
268
269      // CloudRadial
270      "cloudracmd.exe",
271      "cloudrasd.exe",
272      "cloudraservice.exe",
273
274      // ConnectWiseAutomate
275      "agentmon.exe",
276      "ltsvc.exe",
277      "ltsvcmon.exe",
278      "lttray.exe",
279
280      // Devolutions
281      "remotedesktopmanager.exe",
282
283      // Domotz
284      "domotz-windows-x64-10.exe",
285      "domotzagent.exe",
286
287      // DWService
288      "dwagsvc.exe",
289      "dwrcc.exe",
290      "dwrcs.exe",
291      "dwrcst.exe",
292
293      // GetScreen
294      "getscreen.exe",
295
296      // GoTo
297      "g2aservice.exe",
298      "gotoassistservice.exe",
299      "gotohttp.exe",
300      "gotoresolveprocesschecker.exe",
301      "gotoresolveremotecontrol.exe",
302      "gotoresolveservice.exe",
303      "gotoresolveterminal.exe",
304      "gotoresolveunattended.exe",
305
306      // HelpWire
307      "helpwire.exe",
308
309      // ImmyBot
310      "immyagent.exe",
311      "immybot.agent.ephemeral.exe",
312      "immyupdater.exe",
313
314      // Impero
315      "imperoclientsvc.exe",
316      "imperoserversvc.exe",
317
318      // ISLOnline
319      "isllight.exe",
320      "isllightclient.exe",
321
322      // JumpCloud
323      "jumpcloud-agent.exe",
324
325      // Kaseya
326      "saazapsc.exe",
327
328      // Komari
329      "komari-agent.exe",
330      "komari.exe",
331
332      // Level
333      "level.exe",
334      "lvagent.exe",
335
336      // LogMeIn
337      "lmi_rescue_srv.exe",
338      "lmi_rescue.exe",
339      "lmiignition.exe",
340      "logmein.exe",
341
342      // Lunixar
343      "lunixar.exe",
344      "lunixarremote.exe",
345      "lunixarupdater.exe",
346
347      // ManageEngine
348      "manageengine_remote_access_plus.exe",
349
350      // MeshCentral
351      "meshagent.exe",
352
353      // Mikogo
354      "mikogo-service.exe",
355
356      // Nezha
357      "nezha-agent.exe",
358
359      // NinjaOne
360      "ninjarmm-cli.exe",
361      "ninjarmmagent.exe",
362      "ninjarmmagentpatcher.exe",
363
364      // Parsec
365      "parsec.exe",
366
367      // PDQ Connect
368      "pdq-connect-agent.exe",
369      "pdq-connect-updater.exe",
370
371      // Pulseway
372      "pservice.exe",
373
374      // QuickAssist
375      "quickassist.exe",
376
377      // Radmin
378      "r_server.exe",
379      "radmin.exe",
380      "radmin3.exe",
381      "rserver3.exe",
382
383      // RealVNC
384      "romserver.exe",
385      "romviewer.exe",
386      "vncserver.exe",
387      "vncviewer.exe",
388      "winvnc.exe",
389
390      // Remotely
391      "remotely_agent.exe",
392      "remotely_desktop.exe",
393
394      // RemotePC
395      "remotepc.exe",
396      "remotepcdesktop.exe",
397      "remotepcservice.exe",
398
399      // RemoteUtilities
400      "rfusclient.exe",
401      "rutserv.exe",
402      "rutview.exe",
403
404      // RPCSuite
405      "rcclient.exe",
406      "rcservice.exe",
407      "rpcsuite.exe",
408
409      // Rsupport
410      "rcengmgru.exe",
411      "rcmgrsvc.exe",
412      "remoteview.exe",
413      "rvagent.exe",
414      "rvagtray.exe",
415
416      // RustDesk
417      "rustdesk.exe",
418
419      // SimpleHelp
420      "simplegatewayservice.exe",
421      "simplehelpcustomer.exe",
422
423      // Splashtop
424      "smpcview.exe",
425      "spclink.exe",
426      "splashtop-streamer.exe",
427      "splashtopsos.exe",
428      "spsrv.exe",
429      "sragent.exe",
430      "srmanager.exe",
431      "srserver.exe",
432      "srservice.exe",
433      "strwinclt.exe",
434
435      // SuperOps
436      "rmm.agent.exe",
437
438      // Supremo
439      "supremo.exe",
440      "supremoservice.exe",
441
442      // Syncro
443      "syncro.app.runner.exe",
444      "syncro.installer.exe",
445      "syncro.overmind.service.exe",
446      "syncro.service.exe",
447      "syncrolive.agent.exe",
448      "syncrolive.agent.runner.exe",
449      "syncrolive.service.exe",
450
451      // TacticalRMM
452      "tacticalrmm.exe",
453
454      // Tailscale
455      "tailscale.exe",
456      "tailscaled.exe",
457
458      // TeamViewer
459      "teamviewer_desktop.exe",
460      "teamviewer_service.exe",
461      "teamviewer.exe",
462
463      // Techinline
464      "tsclient.exe",
465
466      // Tiflux
467      "tiagent.exe",
468      "ticlientcore.exe",
469
470      // TightVNC
471      "tvn.exe",
472      "tvnserver.exe",
473      "tvnviewer.exe",
474
475      // ToDesk
476      "todesk_service.exe",
477
478      // ToolsIQ
479      "toolsiq.exe",
480
481      // Twingate
482      "twingate.exe",
483
484      // Velociraptor
485      "velociraptor.exe",
486
487      // ZohoAssist
488      "session_win.exe",
489      "za_access.exe",
490      "za_connect.exe",
491      "zaservice.exe",
492      "zmagent.exe",
493      "zohomeeting.exe",
494      "zohotray.exe",
495      "zohours.exe",
496      "zohoursservice.exe"
497    ) OR
498    file.name.caseless LIKE (
499      // AnyAssist
500      "aa_v*.exe",
501
502      // AweSun
503      "aweray_remote*.exe",
504
505      // FleetDeck
506      "fleetdeck_commander*.exe",
507
508      // ScreenConnect
509      "connectwisecontrol*.exe",
510      "screenconnect*.exe",
511
512      // UltraViewer
513      "ultraviewer*.exe",
514
515      // UltraVNC
516      "ultravnc*.exe"
517    )
518  // Keep the executable name paired with its creation time through the host-level aggregation.
519  | EVAL
520      Esql.sequence_stage = "install",
521      Esql.install_candidate = CONCAT(TO_STRING(@timestamp), "|", file.name)
522  | KEEP @timestamp, host.id, _id, _version, _index, Esql.sequence_stage, Esql.install_candidate
523)
524
525| WHERE host.id IS NOT NULL
526
527// Attach known RMM executable creation candidates to all rows on the same host.
528// Retain only download and execution candidates from hosts with at least one such creation.
529| INLINE STATS
530    Esql.install_count = COUNT(*) WHERE Esql.sequence_stage == "install",
531    Esql.install_candidates = VALUES(Esql.install_candidate) WHERE Esql.sequence_stage == "install"
532  BY host.id
533| DROP Esql.install_candidate
534| WHERE Esql.sequence_stage IN ("origin", "execute") AND Esql.install_count > 0
535
536// Lowercase the downloaded path and every msiexec argument, remove the :Zone.Identifier marker,
537// and keep values ending in .msi as the shared path key.
538| EVAL
539    Esql.candidate_path = CASE(
540      Esql.sequence_stage == "origin", file.path,
541      process.args
542    ),
543    Esql.actor_user_id = user.id
544| MV_EXPAND Esql.candidate_path
545| EVAL Esql.artifact_path =
546    REPLACE(TO_LOWER(Esql.candidate_path), ":zone.identifier", "")
547| WHERE Esql.artifact_path LIKE "*.msi" AND Esql.actor_user_id IS NOT NULL
548
549// Match the origin event and msiexec start using host, MSI path, and user SID.
550| INLINE STATS
551    Esql.execute_count = COUNT(*) WHERE Esql.sequence_stage == "execute",
552    Esql.execute_times = VALUES(@timestamp) WHERE Esql.sequence_stage == "execute"
553  BY host.id, Esql.artifact_path, Esql.actor_user_id
554| WHERE
555    // Keep the real origin event as the alert document.
556    Esql.sequence_stage == "origin" AND
557    Esql.execute_count > 0
558
559// Require the matching msiexec process to start within 10 minutes after the MSI download.
560| MV_EXPAND Esql.execute_times
561| EVAL Esql.origin_to_execute_s =
562    DATE_DIFF("second", @timestamp, Esql.execute_times)
563| WHERE
564    Esql.origin_to_execute_s >= 0 AND
565    Esql.origin_to_execute_s <= 600
566
567// On the same host, require any msiexec process to create a known RMM executable
568// within 5 minutes after the matched start.
569| MV_EXPAND Esql.install_candidates
570| EVAL
571    Esql.install_time = TO_DATETIME(MV_FIRST(SPLIT(Esql.install_candidates, "|"))),
572    Esql.rmm_file_name = MV_LAST(SPLIT(Esql.install_candidates, "|")),
573    Esql.execute_to_install_s = DATE_DIFF("second", Esql.execute_times, Esql.install_time)
574| DROP Esql.install_candidates
575| WHERE
576    Esql.execute_to_install_s >= 0 AND
577    Esql.execute_to_install_s <= 300
578
579// Select one concrete origin row per host, MSI path, and user, preferring the
580// earliest RMM executable creation when second-level durations tie.
581| SORT
582    Esql.execute_times ASC,
583    Esql.origin_to_execute_s ASC,
584    Esql.execute_to_install_s ASC,
585    Esql.install_time ASC,
586    Esql.rmm_file_name ASC,
587    _id ASC
588| LIMIT 1 BY host.id, Esql.artifact_path, Esql.actor_user_id
589
590| RENAME Esql.execute_times AS Esql.execute_time
591| KEEP
592    @timestamp, _id, _index, _version,
593    event.action, event.category, event.type, event.created, event.ingested,
594    data_stream.dataset, data_stream.namespace,
595    host.id, host.name,
596    user.id, user.name,
597    process.entity_id, process.name, process.executable, process.command_line,
598    file.name, file.path, file.extension, file.origin_url, file.origin_referrer_url,
599    file.size, file.hash.sha256,
600    Esql.origin.domain, Esql.artifact_path, Esql.execute_time,
601    Esql.install_time, Esql.rmm_file_name,
602    Esql.origin_to_execute_s, Esql.execute_to_install_s
603'''
604
605
606[[rule.threat]]
607framework = "MITRE ATT&CK"
608[[rule.threat.technique]]
609id = "T1105"
610name = "Ingress Tool Transfer"
611reference = "https://attack.mitre.org/techniques/T1105/"
612
613[[rule.threat.technique]]
614id = "T1219"
615name = "Remote Access Tools"
616reference = "https://attack.mitre.org/techniques/T1219/"
617[[rule.threat.technique.subtechnique]]
618id = "T1219.002"
619name = "Remote Desktop Software"
620reference = "https://attack.mitre.org/techniques/T1219/002/"
621
622
623
624[rule.threat.tactic]
625id = "TA0011"
626name = "Command and Control"
627reference = "https://attack.mitre.org/tactics/TA0011/"
628[[rule.threat]]
629framework = "MITRE ATT&CK"
630[[rule.threat.technique]]
631id = "T1218"
632name = "System Binary Proxy Execution"
633reference = "https://attack.mitre.org/techniques/T1218/"
634[[rule.threat.technique.subtechnique]]
635id = "T1218.007"
636name = "Msiexec"
637reference = "https://attack.mitre.org/techniques/T1218/007/"
638
639
640
641[rule.threat.tactic]
642id = "TA0005"
643name = "Defense Evasion"
644reference = "https://attack.mitre.org/tactics/TA0005/"