Windows devinit.exe MSI Download Flag Abuse

title: Windows devinit.exe MSI Download Flag Abuse
id: 209fca08-efdc-42f0-8ac7-a21f963f65ae
status: test
description: This rule flags process executions where the command line includes both the devinit.exe MSI install flag (-t msi-install) and an HTTP-based input (-i http). Such behavior matters because it can be used to fetch and install an arbitrary MSI payload, enabling initial execution and delivery of attacker-controlled software. The detection relies on Windows process creation telemetry and string matching within the recorded command line.
references:
  - https://twitter.com/mrd0x/status/1460815932402679809
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Devinit/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_devinit_lolbin_usage.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-11
modified: 2023-04-06
tags:
  - attack.execution
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - " -t msi-install "
      - " -i http"
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 90d50722-0483-4065-8e35-57efaadd354d
    type: derived