huntrule

Windows Installer Application Removed via MsiInstaller Events

Alerts on Windows Installer events indicating an application was removed via MsiInstaller.

FreeReviewedSigma · Low · v2
Product
windows
Service
application
Author
frack113 (SigmaHQ), DRL 1.1
Published
2022-01-28
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Impact

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies when Windows Installer reports that an application product was removed, using MsiInstaller provider events. Such uninstall activity can be used by an attacker to remove security tooling or disrupt software needed for persistence or defenses. It relies on Windows application/service telemetry from the MsiInstaller provider, specifically Event IDs 1034 (product removed) and 11724 (product removal successful).

Reporting behind it

Related detections9 linkedT1489 — drag to rearrange
Possible Akira Ransomware VM Shutdown via vim-cmd
Possible Ransomware Pre-Encryption VM Termination via esxcli
Malicious Massive Processes Termination Burst (via process_creation)
Malicious Service Deactivation - Command (via process_creation)
Malicious ESXi Virtual Machine Termination and Snapshot Removal
Malicious Stopping of Security or Backup Services Before Impact (via process_creation)
Malicious Massive Services Deletion Burst (via process_creation)
Malicious Security Service Tampering via wmic PathName Query (via process_creation)
Suspicious GhostLocker Watchdog Process Execution (via process_creation)
Windows Installer Application Removed via MsiInstaller Events
Pivot detection · T1489 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.