attack.t1218.007

DllUnregisterServer Function Call Via Msiexec.EXE

Apr 28, 2026 · attack.stealth attack.t1218.007 ·

Share on:

Detects MsiExec loading a DLL and calling its DllUnregisterServer function

MSI Installation From Web

Apr 28, 2026 · attack.stealth attack.t1218 attack.t1218.007 ·

Share on:

Detects installation of a remote msi file from web.

Msiexec Quiet Installation

Apr 28, 2026 · attack.stealth attack.t1218.007 ·

Share on:

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)

MsiExec Web Install

Apr 28, 2026 · attack.stealth attack.t1218.007 attack.command-and-control attack.t1105 ·

Share on:

Detects suspicious msiexec process starts with web addresses as parameter

Obfuscated PowerShell MSI Install via WindowsInstaller COM

Apr 28, 2026 · attack.stealth attack.t1027.010 attack.t1218.007 attack.execution attack.t1059.001 ·

Share on:

Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (WindowsInstaller.Installer). The technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., 'indowsInstaller.Installer'.Insert(0,'W')) and correcting malformed URLs (e.g., converting 'htps://' to 'https://') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection by hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of InstallProduct and COM object creation, particularly combined with hidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction.

PowerShell WMI Win32_Product Install MSI

Apr 28, 2026 · attack.stealth attack.t1218.007 ·

Share on:

Detects the execution of an MSI file using PowerShell and the WMI Win32_Product class

Suspicious MsiExec Embedding Parent

Apr 28, 2026 · attack.stealth attack.t1218.007 ·

Share on:

Adversaries may abuse msiexec.exe to proxy the execution of malicious payloads

Suspicious Msiexec Execute Arbitrary DLL

Apr 28, 2026 · attack.stealth attack.t1218.007 ·

Share on:

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)

Suspicious Msiexec Quiet Install From Remote Location

Apr 28, 2026 · attack.stealth attack.t1218.007 ·

Share on:

Detects usage of Msiexec.exe to install packages hosted remotely quietly

Windows Installer (msiexec.exe) Downloading and Executing Packages

Mar 26, 2024 · attack.defense_evasion attack.t1218 attack.t1218.007 ·

Share on:

To detect suspicious use of msiexec.exe by Raspberry Robin or other threats, it’s essential to take a look at the command line and the URL. Detecting msiexec.exe making outbound network connections to download and install packages in the command-line interface will give you the opportunity to examine the activity and determine if it’s malicious or not. Part of the RedCanary 2024 Threat Detection Report.