Suspicious MSI Deployment From Web (via application)

title: Suspicious MSI Deployment From Web (via application)
id: 0fd1c327-ee3d-5f4d-a5c8-dfc2ef463026
status: stable
description: This rule detects installation of a remote msi file from web.
references:
    - https://attack.mitre.org/techniques/T1218/007/
    - https://attack.mitre.org/techniques/T1218/
    - https://twitter.com/_st0pp3r_/status/1583922009842802689
author: Huntrule Team
date: 2026-03-09
tags:
    - attack.stealth
    - attack.t1218
    - attack.t1218.007
logsource:
    product: windows
    service: application
detection:
    selection:
        Provider_Name: 'MsiInstaller'
        EventID:
            - 1040
            - 1042
        Data|contains: '://'
    condition: selection
falsepositives:
    - Unknown
level: medium