Windows Installer Application Removal (MsiInstaller Event 1034, 11724)

title: Windows Installer Application Removal (MsiInstaller Event 1034, 11724)
id: 6aecf488-793f-4321-9f46-6d2533be3e07
status: test
description: This rule flags Windows Installer activity indicating an application product was removed, using MsiInstaller events for product removal and successful product removal. Attackers may uninstall software to evade defenses, remove traces, or disrupt monitoring by deleting installed components. The detection relies on Windows application/service telemetry from MsiInstaller, specifically EventID 1034 and 11724.
references:
  - https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows11/22H2/W11_22H2_Pro_20221220_22621.963/WEPExplorer/Microsoft-Windows-MsiServer.xml
  - https://learn.microsoft.com/en-us/windows/win32/msi/event-logging
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/msiinstaller/win_builtin_remove_application.yml
author: frack113, Huntrule Team
date: 2022-01-28
modified: 2022-09-17
tags:
  - attack.impact
  - attack.t1489
logsource:
  product: windows
  service: application
detection:
  selection:
    Provider_Name: MsiInstaller
    EventID:
      - 1034
      - 11724
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 570ae5ec-33dc-427c-b815-db86228ad43e
    type: derived