Detects installation of a remote msi file from web.

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)

Detects MsiExec loading a DLL and calling its DllUnregisterServer function

Detects suspicious msiexec process starts with web addresses as parameter

Detects usage of Msiexec.exe to install packages hosted remotely quietly

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)

Detects the execution of an MSI file using PowerShell and the WMI Win32_Product class

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)

Adversaries may abuse msiexec.exe to proxy the execution of malicious payloads