huntrule

PowerShell WMI Win32_Product MSI installation via Invoke-CimMethod

Flags PowerShell using WMI Win32_Product via Invoke-CimMethod to invoke an MSI install.

FreeUnreviewedSigmamediumv1
title: PowerShell WMI Win32_Product MSI installation via Invoke-CimMethod
id: 6f024e79-bbd9-4185-b7cc-f2ea9566693e
status: test
description: This rule identifies PowerShell script block execution that invokes WMI’s Win32_Product class using Invoke-CimMethod, with parameters containing “.msi”. Attackers may use this to stealthily trigger software installation behavior through WMI rather than directly running an MSI. Detection relies on Script Block Logging telemetry capturing the executed PowerShell text.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_win32_product_install_msi.yml
author: frack113, Huntrule Team
date: 2022-04-24
tags:
  - attack.stealth
  - attack.t1218.007
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - "Invoke-CimMethod "
      - "-ClassName "
      - "Win32_Product "
      - "-MethodName "
      - .msi
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 91109523-17f0-4248-a800-f81d9e7c081d
    type: derived

What it detects

This rule identifies PowerShell script block execution that invokes WMI’s Win32_Product class using Invoke-CimMethod, with parameters containing “.msi”. Attackers may use this to stealthily trigger software installation behavior through WMI rather than directly running an MSI. Detection relies on Script Block Logging telemetry capturing the executed PowerShell text.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.