Windows file creation of msiexec.exe under ManageEngine SupportCenter Plus bin

title: Windows file creation of msiexec.exe under ManageEngine SupportCenter Plus bin
id: 97276789-cf88-4e2d-9bdc-8c61f1d1532e
status: test
description: This rule flags creation of an msiexec.exe file located in the ManageEngine\SupportCenterPlus\bin directory on Windows. Attackers exploiting the referenced scenario may drop or masquerade executables in application folders to trigger further execution or persistence. The detection relies on Windows file creation telemetry matching the target file path pattern ending in that specific directory and binary name.
references:
  - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
  - https://github.com/horizon3ai/CVE-2021-44077/blob/b7a48e25824e8ead95e028475c7fd0e107e6e6bf/exploit.py
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-44077/file_event_win_cve_2021_44077_poc_default_files.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-06
tags:
  - attack.execution
  - cve.2021-44077
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: \ManageEngine\SupportCenterPlus\bin\msiexec.exe
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 7b501acf-fa98-4272-aa39-194f82edc8a3
    type: derived