Windows msiexec.exe Initiates Outbound HTTP(S) Connection on Port 80/443
Alerts when msiexec.exe starts outbound connections to ports 80 or 443, indicating potential remote package retrieval.
- Product
- windows
- Category
- network_connection
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-01-16
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies outbound network connections initiated by a Msiexec.exe process to destinations using TCP port 80 or 443. Adversaries may abuse Msiexec.exe to retrieve and execute remotely hosted installation packages, making unexpected web traffic from this binary noteworthy. Telemetry required includes Windows network connection events with the initiating process image name and destination port.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/network_connection/net_connection_win_msiexec_http.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows msiexec.exe Initiates Outbound HTTP(S) Connection on Port 80/443
id: 14dae261-f426-4929-aad7-3bb8386e0efe
status: test
description: This rule identifies outbound network connections initiated by a Msiexec.exe process to destinations using TCP port 80 or 443. Adversaries may abuse Msiexec.exe to retrieve and execute remotely hosted installation packages, making unexpected web traffic from this binary noteworthy. Telemetry required includes Windows network connection events with the initiating process image name and destination port.
references:
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/network_connection/net_connection_win_msiexec_http.yml
author: frack113, Huntrule Team
date: 2022-01-16
modified: 2024-07-16
tags:
- attack.stealth
- attack.t1218.007
- detection.threat-hunting
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: "true"
Image|endswith: \msiexec.exe
DestinationPort:
- 80
- 443
condition: selection
falsepositives:
- Likely
level: low
license: DRL-1.1
related:
- id: 8e5e38e4-5350-4c0b-895a-e872ce0dd54f
type: derived