Suspicious PowerShell MSI Install through WindowsInstaller COM From Remote Location (via process_creation)

title: Suspicious PowerShell MSI Install through WindowsInstaller COM From Remote Location (via process_creation)
id: b42f0657-9b80-574d-b3c7-38d0e2e4c16d
status: stable
description: This rule detects the execution of PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`) hosted remotely. This could be indication of hostile software deployment or lateral movement attempts using Windows Installer functionality. And the use of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection.
references:
    - https://attack.mitre.org/techniques/T1105/
    - https://attack.mitre.org/techniques/T1218/
    - https://attack.mitre.org/techniques/T1059/001/
    - https://informationsecuritybuzz.com/the-real-danger-behind-a-simple-windows-shortcut/
    - https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/
    - https://www.virustotal.com/gui/file/f9710b0ba4de5fa0e7ec27da462d4d2fc6838eba83a19f23f6617a466bbad457
author: Huntrule Team
date: 2026-06-14
tags:
    - attack.execution
    - attack.stealth
    - attack.t1059.001
    - attack.t1218
    - attack.command-and-control
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\powershell_ise.exe'
              - '\powershell.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'PowerShell_ISE.EXE'
              - 'PowerShell.EXE'
              - 'pwsh.dll'
    selection_cli:
        CommandLine|contains|all:
            - '-ComObject'
            - 'InstallProduct('
    selection_remote:
        CommandLine|contains:
            - 'http'
            - '\\\\'
    filter_main_localhost:
        CommandLine|contains:
            - '://127.0.0.1'
            - '://localhost'
    condition: all of selection_* and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium