Windows msiexec.exe Initiated Outbound HTTP(S) Connection on Ports 80/443

title: Windows msiexec.exe Initiated Outbound HTTP(S) Connection on Ports 80/443
id: 14dae261-f426-4929-aad7-3bb8386e0efe
status: test
description: This rule flags outbound network connections where Msiexec.exe initiates traffic to destination ports 80 or 443. Attackers may leverage msiexec.exe to retrieve and execute remotely hosted installation packages, making unusual HTTP(S) activity from this process noteworthy. Detection relies on Windows network connection telemetry that records the initiating process image, connection direction, and destination port.
references:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/network_connection/net_connection_win_msiexec_http.yml
author: frack113, Huntrule Team
date: 2022-01-16
modified: 2024-07-16
tags:
  - attack.stealth
  - attack.t1218.007
  - detection.threat-hunting
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    Image|endswith: \msiexec.exe
    DestinationPort:
      - 80
      - 443
  condition: selection
falsepositives:
  - Likely
level: low
license: DRL-1.1
related:
  - id: 8e5e38e4-5350-4c0b-895a-e872ce0dd54f
    type: derived