Potential Remote Install via MsiExec

  1[metadata]
  2creation_date = "2025/08/19"
  3integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies attempts to install a file from a remote server using MsiExec. Adversaries may abuse Windows Installers
 11for initial access and delivery of malware.
 12"""
 13from = "now-9m"
 14index = [
 15    "endgame-*",
 16    "logs-crowdstrike.fdr*",
 17    "logs-endpoint.events.process-*",
 18    "logs-m365_defender.event-*",
 19    "logs-sentinel_one_cloud_funnel.*",
 20    "logs-system.security*",
 21    "logs-windows.forwarded*",
 22    "logs-windows.sysmon_operational-*",
 23    "winlogbeat-*",
 24]
 25language = "eql"
 26license = "Elastic License v2"
 27name = "Potential Remote Install via MsiExec"
 28risk_score = 73
 29rule_id = "c9847fe9-3bed-4e6b-b319-f9956d6dd02a"
 30severity = "high"
 31tags = [
 32    "Domain: Endpoint",
 33    "OS: Windows",
 34    "Use Case: Threat Detection",
 35    "Tactic: Defense Evasion",
 36    "Data Source: Elastic Endgame",
 37    "Data Source: Elastic Defend",
 38    "Data Source: Windows Security Event Logs",
 39    "Data Source: Microsoft Defender XDR",
 40    "Data Source: Sysmon",
 41    "Data Source: SentinelOne",
 42    "Data Source: Crowdstrike",
 43    "Resources: Investigation Guide",
 44    "Noise: Medium",
 45    "Performance: Normal",
 46    "Profile: Recommended",
 47    "Threat: Living off the Land",
 48    "Threat: Installer Abuse",
 49    "Rule Type: Event Correlation (EQL)",
 50    "Platform: Windows",
 51]
 52timestamp_override = "event.ingested"
 53type = "eql"
 54
 55query = '''
 56process where host.os.type == "windows" and event.type == "start" and
 57  process.name : "msiexec.exe" and process.args : ("-i*", "/i*", "-p*", "/p*") and
 58  process.command_line : ("*http:*", "*https:*") and
 59  process.args : ("/qn", "-qn", "-q", "/q", "/quiet") and
 60  process.parent.name : (
 61    "sihost.exe", "explorer.exe", "cmd.exe", "wscript.exe", "mshta.exe",
 62    "powershell.exe", "wmiprvse.exe", "pcalua.exe", "forfiles.exe", "conhost.exe"
 63  ) and
 64
 65  not process.command_line : (
 66        "*--set-server=*", "*UPGRADEADD=*" , "*--url=*", "*USESERVERCONFIG=*", "*RCTENTERPRISESERVER=*",
 67        "*app.ninjarmm.com*", "*zoom.us/client*", "*SUPPORTSERVERSTSURI=*", "*START_URL=*", "*AUTOCONFIG=*",
 68        "*awscli.amazonaws.com*", "*/i \"C:*", "*/i C:\\*"
 69  )
 70'''
 71
 72note = """## Triage and analysis
 73
 74### Investigating Potential Remote Install via MsiExec
 75#### Possible investigation steps
 76
 77- What remote installer behavior is preserved in the alert?
 78  - Focus: `process.command_line`, `process.parent.name`, and `process.parent.command_line`, especially quiet install or patch switches, the remote MSI or `TRANSFORMS=` source, and HTTP, raw-IP, public-hosting, or recognized distribution sources.
 79  - Implication: escalate for quiet remote installs, remote MSTs, or patches from suspicious infrastructure under interactive or script-launcher parents; lower concern only when the command, source, and parent match one recurring deployment, repair, or onboarding pattern.
 80
 81- Is the msiexec binary identity expected for Windows Installer?
 82  - Focus: `process.executable`, `process.pe.original_file_name`, `process.code_signature.subject_name`, `process.code_signature.trusted`, and `process.hash.sha256`.
 83  - Implication: escalate faster when msiexec is renamed, unsigned, untrusted, newly seen, or in a user-writable path; trusted Microsoft identity only confirms the proxy binary, not the remote install.
 84
 85- Does the parent and ancestry explain why msiexec ran?
 86  - Focus: `process.parent.executable`, `process.parent.command_line`, `process.Ext.ancestry`, `user.id`, and the affected host.
 87  - Implication: escalate when browser-adjacent, script, shell, WMI, or unusual interactive ancestry invokes the remote package without a stable workflow; lower concern when the parent, user, and host pattern fits a recognized management or support path.
 88
 89- Do process events show payload execution after the installer starts?
 90  - Focus: child starts on the same `host.id` where `process.parent.entity_id` matches `process.entity_id`, checking child `process.command_line`, `process.executable`, and `process.hash.sha256`. $investigate_0
 91  - Hint: use `host.id` + `process.pid` + tight alert window only when entity linkage is unavailable, and treat the result as weaker.
 92  - Implication: escalate when msiexec spawns shells, script interpreters, LOLBins, scheduled-task tools, or user-space binaries tied to the remote package; lower concern when follow-on activity stays inside the same signed product install flow.
 93
 94- Does the remote source and workflow context fit one legitimate package path?
 95  - Focus: URL, host, package name, or remote `TRANSFORMS=` in `process.command_line`, plus `process.parent.executable`, `user.id`, and `host.id` context for that source.
 96  - Hint: if network or file telemetry exists, correlate destination or artifact evidence with `host.id` + `process.entity_id`; use `host.id` + `process.pid` + tight alert window only without entity linkage. Missing file or network telemetry is unresolved, not benign, and does not block escalation when process evidence is strong. $investigate_1
 97  - Implication: escalate when the source is raw IPs, public file hosting, look-alike vendors, temp/download staging, or infrastructure unrelated to the expected product; lower concern when source, launcher, user-host scope, and recovered corroboration fit one internal distribution point or vendor service.
 98
 99- Escalate on suspicious quiet-install intent, mismatched identity or lineage, unfit package source, or payload child execution; close only when process evidence and recovered corroboration align to one exact deployment, repair, or support workflow; preserve and escalate when evidence is mixed or visibility is incomplete. Use same-user or same-host related alerts after escalation only to size scope, not prove the local alert. $investigate_2 $investigate_3
100
101### False positive analysis
102
103- First check whether `http:` or `https:` follows `/i` or `/p` directly (remote source -- investigate) or sits inside a `PROPERTY=` value while the MSI source is local or relative (configuration URL -- likely benign). The rule excludes local `C:\\` sources after `/i`; UNC, relative-path, or other local sources with property URLs need manual confirmation or customer-side exceptions.
104- Legitimate deployment, patching, or agent-repair workflows can use quiet remote msiexec. Confirm when `process.command_line`, `process.parent.executable`, `user.id`, and `host.id` align to one recurring product path. Do not close on a vendor-looking URL, signed msiexec, or familiar parent name alone.
105- Build exceptions from `process.parent.executable`, package source pattern in `process.command_line`, and stable `host.id` or `user.id` cohort. Avoid exceptions on msiexec, `process.parent.name`, domain suffix, or `user.name` alone.
106
107### Response and remediation
108
109- If confirmed benign, reverse any temporary containment and record the installer command, remote package source, parent launcher, signer/hash identity, affected `user.id`, affected `host.id`, and any recovered destination or artifact pattern. Create an exception only after the same workflow recurs across prior alerts from this rule.
110- If suspicious but unconfirmed, preserve the alert record, process tree, `process.entity_id` values, installer command line, remote URL or `TRANSFORMS=` value, parent command line, child process records, and any recovered package, destination, or provenance artifacts before containment. Apply reversible controls only when command, parent, or child-process evidence suggests active delivery; otherwise keep evidence collection open rather than starting cleanup.
111- If confirmed malicious, preserve process identifiers, command lines, recovered packages, and destination indicators before isolating the host, terminating msiexec or follow-on payloads, blocking confirmed indicators, or removing staged installers, extracted payloads, persistence changes, or scheduled-task material tied to the chain.
112- Post-incident hardening: close the delivery path that introduced the remote package, restrict msiexec remote-install use to controlled deployment tooling where feasible, review hosts where installer-elevation policy would increase impact, and document adjacent variants such as remote `TRANSFORMS=` abuse or DLL registration through `/y` and `/z`.
113"""
114
115setup = """## Setup
116
117This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
118
119Setup instructions: https://ela.st/install-elastic-defend
120
121### Additional data sources
122
123This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
124
125- [CrowdStrike](https://ela.st/crowdstrike-integration)
126- [Microsoft Defender XDR](https://ela.st/m365-defender)
127- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
128- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
129- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
130"""
131
132[rule.investigation_fields]
133field_names = [
134    "@timestamp",
135    "host.id",
136    "user.id",
137    "process.entity_id",
138    "process.pid",
139    "process.executable",
140    "process.command_line",
141    "process.args",
142    "process.hash.sha256",
143    "process.parent.entity_id",
144    "process.parent.executable",
145    "process.parent.command_line",
146    "process.pe.original_file_name",
147    "process.code_signature.subject_name",
148    "process.code_signature.trusted",
149]
150
151[transform]
152
153[[transform.investigate]]
154label = "Child process activity from msiexec"
155description = ""
156providers = [
157  [
158    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
159    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
160    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
161    { excluded = false, field = "event.type", queryType = "phrase", value = "start", valueType = "string" }
162  ]
163]
164relativeFrom = "now-1h"
165relativeTo = "now"
166
167[[transform.investigate]]
168label = "File or network activity by msiexec"
169description = ""
170providers = [
171  [
172    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
173    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
174    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" }
175  ],
176  [
177    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
178    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
179    { excluded = false, field = "event.category", queryType = "phrase", value = "network", valueType = "string" }
180  ]
181]
182relativeFrom = "now-1h"
183relativeTo = "now"
184
185[[transform.investigate]]
186label = "Alerts associated with the user"
187description = ""
188providers = [
189  [
190    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
191    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
192  ]
193]
194relativeFrom = "now-48h/h"
195relativeTo = "now"
196
197[[transform.investigate]]
198label = "Alerts associated with the host"
199description = ""
200providers = [
201  [
202    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
203    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
204  ]
205]
206relativeFrom = "now-48h/h"
207relativeTo = "now"
208
209[[rule.threat]]
210framework = "MITRE ATT&CK"
211[[rule.threat.technique]]
212id = "T1218"
213name = "System Binary Proxy Execution"
214reference = "https://attack.mitre.org/techniques/T1218/"
215[[rule.threat.technique.subtechnique]]
216id = "T1218.007"
217name = "Msiexec"
218reference = "https://attack.mitre.org/techniques/T1218/007/"
219
220[rule.threat.tactic]
221id = "TA0005"
222name = "Defense Evasion"
223reference = "https://attack.mitre.org/tactics/TA0005/"
224
225[[rule.threat]]
226framework = "MITRE ATT&CK"
227
228[[rule.threat.technique]]
229id = "T1105"
230name = "Ingress Tool Transfer"
231reference = "https://attack.mitre.org/techniques/T1105/"
232
233[rule.threat.tactic]
234id = "TA0011"
235name = "Command and Control"
236reference = "https://attack.mitre.org/tactics/TA0011/"