Windows: ManageEngine SupportCenter Plus msiexec.exe Dropped in bin (CVE-2021-44077 POC)
Alerts on msiexec.exe being created in the SupportCenterPlus bin folder on Windows.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-06-06
- Updated
- 2026-07-31
What it detects
This rule flags file creation where msiexec.exe is written under the ManageEngine SupportCenter Plus installation bin directory. Dropping or placing a binary with a familiar name in an application-controlled path can be used to execute attacker-controlled components related to the referenced proof-of-concept behavior. It relies on Windows file event telemetry capturing the full target filename for process-binary drops.
Reporting behind it
- thedfirreport.comhttps://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
- github.comhttps://github.com/horizon3ai/CVE-2021-44077/blob/b7a48e25824e8ead95e028475c7fd0e107e6e6bf/exploit.py
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-44077/file_event_win_cve_2021_44077_poc_default_files.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-file-creation-of-msiexec-exe-under-manageengine-supportcenter-plus-bin-7b501acf
title: "Windows: ManageEngine SupportCenter Plus msiexec.exe Dropped in bin (CVE-2021-44077 POC)"
id: 97276789-cf88-4e2d-9bdc-8c61f1d1532e
status: test
description: This rule flags file creation where msiexec.exe is written under the ManageEngine SupportCenter Plus installation bin directory. Dropping or placing a binary with a familiar name in an application-controlled path can be used to execute attacker-controlled components related to the referenced proof-of-concept behavior. It relies on Windows file event telemetry capturing the full target filename for process-binary drops.
references:
- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
- https://github.com/horizon3ai/CVE-2021-44077/blob/b7a48e25824e8ead95e028475c7fd0e107e6e6bf/exploit.py
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-44077/file_event_win_cve_2021_44077_poc_default_files.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-06
tags:
- attack.execution
- cve.2021-44077
- detection.emerging-threats
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|endswith: \ManageEngine\SupportCenterPlus\bin\msiexec.exe
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 7b501acf-fa98-4272-aa39-194f82edc8a3
type: derived