Windows Installer Application Removed via MsiInstaller Events

Alerts on Windows Installer events indicating an application was removed via MsiInstaller.

FreeReviewedSigma · Low · v2

Product: windows
Service: application
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2022-01-28
Updated: 2026-07-31

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1489Service Stop

What it detects

This rule identifies when Windows Installer reports that an application product was removed, using MsiInstaller provider events. Such uninstall activity can be used by an attacker to remove security tooling or disrupt software needed for persistence or defenses. It relies on Windows application/service telemetry from the MsiInstaller provider, specifically Event IDs 1034 (product removed) and 11724 (product removal successful).

Reporting behind it

Related detections9 linkedT1489 — drag to rearrange

Possible Akira Ransomware VM Shutdown via vim-cmd

Possible Ransomware Pre-Encryption VM Termination via esxcli

Malicious Massive Processes Termination Burst (via process_creation)

Malicious Service Deactivation - Command (via process_creation)

Malicious ESXi Virtual Machine Termination and Snapshot Removal

Malicious Stopping of Security or Backup Services Before Impact (via process_creation)

Malicious Massive Services Deletion Burst (via process_creation)

Malicious Security Service Tampering via wmic PathName Query (via process_creation)

Suspicious GhostLocker Watchdog Process Execution (via process_creation)

Windows Installer Application Removed via MsiInstaller Events

Pivot detection · T1489 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-installer-application-removal-msiinstaller-event-1034-11724-570ae5ec

title: Windows Installer Application Removed via MsiInstaller Events
id: 6aecf488-793f-4321-9f46-6d2533be3e07
status: test
description: This rule identifies when Windows Installer reports that an application product was removed, using MsiInstaller provider events. Such uninstall activity can be used by an attacker to remove security tooling or disrupt software needed for persistence or defenses. It relies on Windows application/service telemetry from the MsiInstaller provider, specifically Event IDs 1034 (product removed) and 11724 (product removal successful).
references:
  - https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows11/22H2/W11_22H2_Pro_20221220_22621.963/WEPExplorer/Microsoft-Windows-MsiServer.xml
  - https://learn.microsoft.com/en-us/windows/win32/msi/event-logging
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/msiinstaller/win_builtin_remove_application.yml
author: frack113, Huntrule Team
date: 2022-01-28
modified: 2022-09-17
tags:
  - attack.impact
  - attack.t1489
logsource:
  product: windows
  service: application
detection:
  selection:
    Provider_Name: MsiInstaller
    EventID:
      - 1034
      - 11724
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 570ae5ec-33dc-427c-b815-db86228ad43e
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL