-
MsiExec Service Child Process With Network Connection
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Defense Evasion Data Source: Elastic Defend Data Source: Sysmon Data Source: SentinelOne Resources: Investigation Guide Noise: Medium Performance: Normal Profile: Recommended Threat: Living off the Land Threat: Installer Abuse Rule Type: Event Correlation (EQL) Platform: Windows ·Identifies the execution of an MsiExec service child process followed by network or dns lookup activity. Adversaries may abuse Windows Installers for initial access and delivery of malware.
Read More -
Persistence via a Windows Installer
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Persistence Tactic: Defense Evasion Data Source: Elastic Defend Resources: Investigation Guide Noise: Medium Performance: Normal Profile: Recommended Threat: Living off the Land Threat: Installer Abuse Rule Type: Event Correlation (EQL) Platform: Windows ·Identifies when the Windows installer process msiexec.exe creates a new persistence entry via scheduled tasks or startup.
Read More -
Potential Remote File Execution via MSIEXEC
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Initial Access Tactic: Defense Evasion Data Source: Elastic Defend Resources: Investigation Guide Noise: Medium Performance: Normal Threat: Living off the Land Threat: Installer Abuse Rule Type: Event Correlation (EQL) Platform: Windows ·Identifies the execution of the built-in Windows Installer, msiexec.exe, to install a remote package. Adversaries may abuse msiexec.exe to launch local or network accessible MSI files.
Read More -
Potential Remote Install via MsiExec
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Defense Evasion Data Source: Elastic Endgame Data Source: Elastic Defend Data Source: Windows Security Event Logs Data Source: Microsoft Defender XDR Data Source: Sysmon Data Source: SentinelOne Data Source: Crowdstrike Resources: Investigation Guide Noise: Medium Performance: Normal Profile: Recommended Threat: Living off the Land Threat: Installer Abuse Rule Type: Event Correlation (EQL) Platform: Windows ·Identifies attempts to install a file from a remote server using MsiExec. Adversaries may abuse Windows Installers for initial access and delivery of malware.
Read More -
Suspicious Installer Package Spawns Network Event
Sep 19, 2026 · Domain: Endpoint OS: macOS Use Case: Threat Detection Tactic: Execution Tactic: Command and Control Data Source: Elastic Defend Resources: Investigation Guide Noise: Low Performance: Normal Profile: Recommended Threat: Supply Chain Threat: Installer Abuse Rule Type: Event Correlation (EQL) Platform: macOS ·Detects the execution of a MacOS installer package with an abnormal child process (e.g bash) followed immediately by a network connection via a suspicious process (e.g curl). Threat actors will build and distribute malicious MacOS installer packages, which have a .pkg extension, many times imitating valid software in order to persuade and infect their victims often using the package files (e.g pre/post install scripts etc.) to download additional tools or malicious software. If this rule fires it should indicate the installation of a malicious or suspicious package.
Read More