Potential Remote File Execution via MSIEXEC

  1[metadata]
  2creation_date = "2023/09/28"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies the execution of the built-in Windows Installer, msiexec.exe, to install a remote package. Adversaries may
 11abuse msiexec.exe to launch local or network accessible MSI files.
 12"""
 13from = "now-9m"
 14index = ["logs-endpoint.events.process-*", "logs-endpoint.events.network-*"]
 15language = "eql"
 16license = "Elastic License v2"
 17name = "Potential Remote File Execution via MSIEXEC"
 18risk_score = 21
 19rule_id = "3e441bdb-596c-44fd-8628-2cfdf4516ada"
 20severity = "low"
 21tags = [
 22    "Domain: Endpoint",
 23    "OS: Windows",
 24    "Use Case: Threat Detection",
 25    "Tactic: Initial Access",
 26    "Tactic: Defense Evasion",
 27    "Data Source: Elastic Defend",
 28    "Resources: Investigation Guide",
 29    "Noise: Medium",
 30    "Performance: Normal",
 31    "Threat: Living off the Land",
 32    "Threat: Installer Abuse",
 33    "Rule Type: Event Correlation (EQL)",
 34    "Platform: Windows",
 35]
 36type = "eql"
 37
 38query = '''
 39sequence with maxspan=1m
 40 [process where host.os.type == "windows" and event.action == "start" and
 41    process.name : "msiexec.exe" and process.args : "/V"] by process.entity_id
 42 [network where host.os.type == "windows" and process.name : "msiexec.exe" and
 43    event.action == "connection_attempted"] by process.entity_id
 44 [process where host.os.type == "windows" and event.action == "start" and
 45  process.parent.name : "msiexec.exe" and user.id : ("S-1-5-21-*", "S-1-5-12-1-*") and
 46  not process.executable : ("?:\\Windows\\SysWOW64\\msiexec.exe",
 47                            "?:\\Windows\\System32\\msiexec.exe",
 48                            "?:\\Windows\\System32\\srtasks.exe",
 49                            "?:\\Windows\\SysWOW64\\srtasks.exe",
 50                            "?:\\Windows\\System32\\taskkill.exe",
 51                            "?:\\Windows\\Installer\\MSI*.tmp",
 52                            "?:\\Program Files\\*.exe",
 53                            "?:\\Program Files (x86)\\*.exe",
 54                            "?:\\Windows\\System32\\ie4uinit.exe",
 55                            "?:\\Windows\\SysWOW64\\ie4uinit.exe",
 56                            "?:\\Windows\\System32\\sc.exe",
 57                            "?:\\Windows\\system32\\Wbem\\mofcomp.exe",
 58                            "?:\\Windows\\twain_32\\fjscan32\\SOP\\crtdmprc.exe",
 59                            "?:\\Windows\\SysWOW64\\taskkill.exe",
 60                            "?:\\Windows\\SysWOW64\\schtasks.exe",
 61                            "?:\\Windows\\system32\\schtasks.exe",
 62                            "?:\\Windows\\System32\\sdbinst.exe") and
 63  not (process.code_signature.subject_name == "Citrix Systems, Inc." and process.code_signature.trusted == true) and
 64  not (process.name : ("regsvr32.exe", "powershell.exe", "rundll32.exe", "wscript.exe") and
 65       process.Ext.token.integrity_level_name == "high" and
 66       process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and
 67  not (process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and process.code_signature.trusted == true) and
 68  not (process.name : "rundll32.exe" and process.args : "printui.dll,PrintUIEntry")
 69  ] by process.parent.entity_id
 70'''
 71
 72setup = """## Setup
 73
 74This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
 75
 76Setup instructions: https://ela.st/install-elastic-defend
 77"""
 78
 79note = """## Triage and analysis
 80
 81> **Disclaimer**:
 82> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 83
 84### Investigating Potential Remote File Execution via MSIEXEC
 85
 86MSIEXEC, the Windows Installer, facilitates software installation, modification, and removal. Adversaries exploit it to execute remote MSI files, bypassing security controls. The detection rule identifies suspicious MSIEXEC activity by monitoring process starts, network connections, and child processes, filtering out known benign signatures and paths, thus highlighting potential misuse for initial access or defense evasion.
 87
 88### Possible investigation steps
 89
 90- Review the process start event for msiexec.exe to identify the command-line arguments used, focusing on the presence of the "/V" flag, which indicates a remote installation attempt.
 91- Examine the network connection attempts associated with msiexec.exe to determine the remote IP addresses or domains being contacted, and assess their reputation or any known associations with malicious activity.
 92- Investigate the child processes spawned by msiexec.exe, especially those not matching known benign executables or paths, to identify any suspicious or unexpected activity.
 93- Check the user ID associated with the msiexec.exe process to verify if it aligns with expected user behavior or if it indicates potential compromise, especially focusing on user IDs like "S-1-5-21-*" or "S-1-5-12-1-*".
 94- Analyze the code signature of any child processes to ensure they are trusted and expected, paying particular attention to any unsigned or untrusted executables.
 95- Correlate the alert with any recent phishing attempts or suspicious emails received by the user, as the MITRE ATT&CK technique T1566 (Phishing) is associated with this rule.
 96
 97### False positive analysis
 98
 99- Legitimate software installations using msiexec.exe may trigger the rule. To manage this, create exceptions for known software update processes that use msiexec.exe with trusted code signatures.
100- System maintenance tasks that involve msiexec.exe, such as Windows updates or system repairs, can be excluded by identifying and allowing specific system paths and executables involved in these processes.
101- Enterprise software deployment tools that utilize msiexec.exe for remote installations might cause false positives. Exclude these by verifying the code signature and adding exceptions for trusted deployment tools.
102- Administrative scripts or automation tools that invoke msiexec.exe for legitimate purposes should be reviewed and, if verified as safe, excluded based on their execution context and code signature.
103- Network monitoring tools or security software that simulate msiexec.exe activity for testing or monitoring purposes can be excluded by identifying their specific signatures and paths.
104
105### Response and remediation
106
107- Isolate the affected system from the network to prevent further unauthorized access or data exfiltration. This can be done by disabling network interfaces or moving the system to a quarantine VLAN.
108- Terminate the msiexec.exe process if it is still running to stop any ongoing malicious activity. Use task management tools or scripts to ensure the process is completely stopped.
109- Conduct a thorough review of the system for any unauthorized changes or installations. Check for newly installed software or modifications to system files that could indicate further compromise.
110- Restore the system from a known good backup if unauthorized changes are detected and cannot be easily reversed. Ensure the backup is clean and free from any malicious alterations.
111- Update and patch the system to the latest security standards to close any vulnerabilities that may have been exploited. This includes applying all relevant Windows updates and security patches.
112- Enhance monitoring and logging on the affected system and network to detect any similar future attempts. Ensure that all relevant security events are being captured and analyzed.
113- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected. Provide them with all relevant logs and findings for a comprehensive analysis."""
114
115
116[[rule.threat]]
117framework = "MITRE ATT&CK"
118
119[[rule.threat.technique]]
120id = "T1566"
121name = "Phishing"
122reference = "https://attack.mitre.org/techniques/T1566/"
123
124[[rule.threat.technique.subtechnique]]
125id = "T1566.002"
126name = "Spearphishing Link"
127reference = "https://attack.mitre.org/techniques/T1566/002/"
128
129[rule.threat.tactic]
130id = "TA0001"
131name = "Initial Access"
132reference = "https://attack.mitre.org/tactics/TA0001/"
133
134[[rule.threat]]
135framework = "MITRE ATT&CK"
136
137[[rule.threat.technique]]
138id = "T1218"
139name = "System Binary Proxy Execution"
140reference = "https://attack.mitre.org/techniques/T1218/"
141
142[[rule.threat.technique.subtechnique]]
143id = "T1218.007"
144name = "Msiexec"
145reference = "https://attack.mitre.org/techniques/T1218/007/"
146
147[rule.threat.tactic]
148id = "TA0005"
149name = "Defense Evasion"
150reference = "https://attack.mitre.org/tactics/TA0005/"
151
152[[rule.threat]]
153framework = "MITRE ATT&CK"
154
155[[rule.threat.technique]]
156id = "T1105"
157name = "Ingress Tool Transfer"
158reference = "https://attack.mitre.org/techniques/T1105/"
159
160[rule.threat.tactic]
161id = "TA0011"
162name = "Command and Control"
163reference = "https://attack.mitre.org/tactics/TA0011/"