Windows msiexec.exe Installer Process Spawning cmd.exe or PowerShell

title: Windows msiexec.exe Installer Process Spawning cmd.exe or PowerShell
id: dc6dd16e-541f-4d92-bba2-b960277519f5
status: test
description: This rule identifies instances where a Windows Installer temporary process (Windows\Installer\*msi* ending in tmp, including msiexec activity) spawns command or PowerShell interpreters. Attackers commonly use installer-driven execution paths to run arbitrary commands under elevated or trusted contexts. The detection relies on process creation telemetry, matching parent process image characteristics and child process image filenames for cmd.exe, powershell.exe, or pwsh.exe.
references:
  - https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-50-638.jpg
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_elavated_msi_spawned_shell.yml
author: Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community, Huntrule Team
date: 2020-10-13
modified: 2022-10-20
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith:
        - \cmd.exe
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - Cmd.Exe
        - PowerShell.EXE
        - pwsh.dll
  selection_parent:
    ParentImage|contains|all:
      - \Windows\Installer\
      - msi
    ParentImage|endswith: tmp
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 1e53dd56-8d83-4eb4-a43e-b790a05510aa
    type: derived