{"id":"T1218.007","name":"Msiexec","url":"https://attack.mitre.org/techniques/T1218/007","tactics":["stealth"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0158","stix_id":"x-mitre-detection-strategy--0602b47a-d37c-4eee-ac4b-b464060945ab","name":"Detection of Msiexec Abuse for Local, Network, and DLL Execution","url":"https://attack.mitre.org/detectionstrategies/DET0158","analytics":[{"id":"AN0445","stix_id":"x-mitre-analytic--f27c0482-fbea-47a3-9b19-7302a058a9e5","name":"Analytic 0445","description":"Detection of msiexec.exe execution where command-line arguments reference remote MSI packages, UNC paths, HTTP/HTTPS URLs, or DLLs, correlated with subsequent module loads and/or network connections to previously unseen destinations. The behavioral chain links process creation of msiexec.exe with suspicious parameters, network activity to retrieve payloads, and module loading indicative of malicious installation or DLL execution.","url":"https://attack.mitre.org/detectionstrategies/DET0158#AN0445","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"SuspiciousCommandlinePatterns","description":"Patterns for identifying malicious msiexec.exe usage (e.g., UNC paths, external domains, DLL execution flags)"},{"field":"SuspiciousDestinationList","description":"List of external domains or IP ranges considered suspicious for msiexec network connections"},{"field":"TimeWindow","description":"Time range in seconds/minutes for correlating msiexec.exe execution with module load and network activity"},{"field":"LegitimateMSIHashes","description":"Hash list of MSI packages considered known-good to reduce false positives"}],"live":true,"detection_strategies":["DET0158"],"techniques":["T1218.007"]}],"live":true,"version":"1.0","techniques":["T1218.007"]}],"sigma_rules":[{"id":"4a2a2c3e-209f-4d01-b513-4155a540b469","title":"Suspicious MsiExec Embedding Parent","author":"frack113","status":"test","level":"medium","date":"2022-04-16","modified":"2022-07-14","description":"Adversaries may abuse msiexec.exe to proxy the execution of malicious payloads","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218.007"],"path":"rules/windows/process_creation/proc_creation_win_msiexec_embedding.yml","techniques":["T1218.007"],"cves":[]},{"id":"5594e67a-7f92-4a04-b65d-1a42fd824a60","title":"MSI Installation From Web","author":"Stamatis Chatzimangou","status":"test","level":"medium","date":"2022-10-23","modified":null,"description":"Detects installation of a remote msi file from web.","references":["https://twitter.com/_st0pp3r_/status/1583922009842802689"],"logsource":{"product":"windows","service":"application"},"tags":["attack.stealth","attack.t1218","attack.t1218.007"],"path":"rules/windows/builtin/application/msiinstaller/win_msi_install_from_web.yml","techniques":["T1218","T1218.007"],"cves":[]},{"id":"6f4191bb-912b-48a8-9ce7-682769541e6d","title":"Suspicious Msiexec Execute Arbitrary DLL","author":"frack113","status":"test","level":"medium","date":"2022-01-16","modified":"2026-01-09","description":"Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.\nMsiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)\n","references":["https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md","https://twitter.com/_st0pp3r_/status/1583914515996897281"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218.007"],"path":"rules/windows/process_creation/proc_creation_win_msiexec_execute_dll.yml","techniques":["T1218.007"],"cves":[]},{"id":"79a87aa6-e4bd-42fc-a5bb-5e6fbdcd62f5","title":"Msiexec Quiet Installation","author":"frack113","status":"test","level":"medium","date":"2022-01-16","modified":"2026-07-28","description":"Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.\nMsiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)\n","references":["https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md","https://twitter.com/_st0pp3r_/status/1583914244344799235"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218.007"],"path":"rules/windows/process_creation/proc_creation_win_msiexec_install_quiet.yml","techniques":["T1218.007"],"cves":[]},{"id":"7b6a7418-3afc-11f0-aff4-000d3abf478c","title":"Obfuscated PowerShell MSI Install via WindowsInstaller COM","author":"Meroujan Antonyan (vx3r)","status":"experimental","level":"high","date":"2025-05-27","modified":null,"description":"Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`).\nThe technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., 'indowsInstaller.Installer'.Insert(0,'W')) and correcting\nmalformed URLs (e.g., converting 'htps://' to 'https://') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection\nby hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of `InstallProduct` and COM object creation, particularly combined with\nhidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction.\n","references":["https://informationsecuritybuzz.com/the-real-danger-behind-a-simple-windows-shortcut/","https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/","https://www.virustotal.com/gui/file/f9710b0ba4de5fa0e7ec27da462d4d2fc6838eba83a19f23f6617a466bbad457"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027.010","attack.t1218.007","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_comobject_msi.yml","techniques":["T1027.010","T1218.007","T1059.001"],"cves":[]},{"id":"8150732a-0c9d-4a99-82b9-9efb9b90c40c","title":"Suspicious Msiexec Quiet Install From Remote Location","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-10-28","modified":"2025-10-07","description":"Detects usage of Msiexec.exe to install packages hosted remotely quietly","references":["https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218.007"],"path":"rules/windows/process_creation/proc_creation_win_msiexec_install_remote.yml","techniques":["T1218.007"],"cves":[]},{"id":"84f52741-8834-4a8c-a413-2eb2269aa6c8","title":"DllUnregisterServer Function Call Via Msiexec.EXE","author":"frack113","status":"test","level":"medium","date":"2022-04-24","modified":"2024-03-13","description":"Detects MsiExec loading a DLL and calling its DllUnregisterServer function","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md","https://lolbas-project.github.io/lolbas/Binaries/Msiexec/","https://twitter.com/_st0pp3r_/status/1583914515996897281"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218.007"],"path":"rules/windows/process_creation/proc_creation_win_msiexec_dll.yml","techniques":["T1218.007"],"cves":[]},{"id":"8e5e38e4-5350-4c0b-895a-e872ce0dd54f","title":"Msiexec.EXE Initiated Network Connection Over HTTP","author":"frack113","status":"test","level":"low","date":"2022-01-16","modified":"2024-07-16","description":"Detects a network connection initiated by an \"Msiexec.exe\" process over port 80 or 443.\nAdversaries might abuse \"msiexec.exe\" to install and execute remotely hosted packages.\nUse this rule to hunt for potentially anomalous or suspicious communications.\n","references":["https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md"],"logsource":{"product":"windows","category":"network_connection"},"tags":["attack.stealth","attack.t1218.007","detection.threat-hunting"],"path":"rules-threat-hunting/windows/network_connection/net_connection_win_msiexec_http.yml","techniques":["T1218.007"],"cves":[]},{"id":"91109523-17f0-4248-a800-f81d9e7c081d","title":"PowerShell WMI Win32_Product Install MSI","author":"frack113","status":"test","level":"medium","date":"2022-04-24","modified":null,"description":"Detects the execution of an MSI file using PowerShell and the WMI Win32_Product class","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1218.007"],"path":"rules/windows/powershell/powershell_script/posh_ps_win32_product_install_msi.yml","techniques":["T1218.007"],"cves":[]},{"id":"f7b5f842-a6af-4da5-9e95-e32478f3cd2f","title":"MsiExec Web Install","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2018-02-09","modified":"2022-01-07","description":"Detects suspicious msiexec process starts with web addresses as parameter","references":["https://blog.trendmicro.com/trendlabs-security-intelligence/attack-using-windows-installer-msiexec-exe-leads-lokibot/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218.007","attack.command-and-control","attack.t1105"],"path":"rules/windows/process_creation/proc_creation_win_msiexec_web_install.yml","techniques":["T1218.007","T1105"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}