Windows msiexec.exe Installer Process Spawning cmd.exe or PowerShell

Flags installer-initiated spawning of cmd.exe or PowerShell from Windows\Installer temporary msi-related processes.

FreeReviewedSigma · Medium · v1

Product: windows
Category: process_creation
Author: Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community (SigmaHQ), DRL 1.1
Published: 2020-10-13
Updated: 2026-07-30

ATT&CK techniques

Priv Esc → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
- T1548.002Bypass User Account Control
Defense Evasion
- T1548.002Bypass User Account Control
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies instances where a Windows Installer temporary process (Windows\Installer\*msi* ending in tmp, including msiexec activity) spawns command or PowerShell interpreters. Attackers commonly use installer-driven execution paths to run arbitrary commands under elevated or trusted contexts. The detection relies on process creation telemetry, matching parent process image characteristics and child process image filenames for cmd.exe, powershell.exe, or pwsh.exe.

Reporting behind it

Related detections9 linkedT1548.002 — drag to rearrange

Possible UAC Bypass via easinvoker Spawning Batch Script (via process_creation)

Suspicious UAC Bypass by Disabling Admin Consent Prompt via registry_set

Malicious Cloud Atlas UAC Bypass via fodhelper (via process_creation)

Suspicious computerdefaults.exe Spawning Child Process

Suspicious UAC Bypass via control.exe App Paths or Shell Open Command Hijack

Malicious UAC Bypass via COMAutoApprovalList Registry Modification (via registry_set)

Suspicious UAC Bypass via COMAutoApprovalList Registry Modification (via registry_set)

Malicious UAC Bypass via explorer.exe NOUACCHECK Argument

Suspicious UAC Bypass via ms-settings Shell Command Hijack (via registry_set)

Windows msiexec.exe Installer Process Spawning cmd.exe or PowerShell

Pivot detection · T1548.002 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-msiexec-exe-installer-process-spawning-cmd-exe-or-powershell-1e53dd56

title: Windows msiexec.exe Installer Process Spawning cmd.exe or PowerShell
id: dc6dd16e-541f-4d92-bba2-b960277519f5
status: test
description: This rule identifies instances where a Windows Installer temporary process (Windows\Installer\*msi* ending in tmp, including msiexec activity) spawns command or PowerShell interpreters. Attackers commonly use installer-driven execution paths to run arbitrary commands under elevated or trusted contexts. The detection relies on process creation telemetry, matching parent process image characteristics and child process image filenames for cmd.exe, powershell.exe, or pwsh.exe.
references:
  - https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-50-638.jpg
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_elavated_msi_spawned_shell.yml
author: Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community, Huntrule Team
date: 2020-10-13
modified: 2022-10-20
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith:
        - \cmd.exe
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - Cmd.Exe
        - PowerShell.EXE
        - pwsh.dll
  selection_parent:
    ParentImage|contains|all:
      - \Windows\Installer\
      - msi
    ParentImage|endswith: tmp
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 1e53dd56-8d83-4eb4-a43e-b790a05510aa
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL