Windows msiexec.exe Quiet MSI Installation with Installer Arguments
Flags msiexec.exe launched with -q plus MSI installer switches, indicating quiet installation behavior in Windows process creation logs.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-01-16
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process creation events where msiexec.exe is launched with silent/quiet behavior and MSI installer-related arguments (-i, -package, -a, -j) including the -q flag. Attackers may use msiexec.exe to run installer packages covertly while reducing user visibility and blending into legitimate installation workflows. The detection relies on Windows process creation telemetry, matching the msiexec.exe image/original filename and parsing the command line for the presence of specific installer switches.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md
- twitter.comhttps://twitter.com/_st0pp3r_/status/1583914244344799235
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_msiexec_install_quiet.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows msiexec.exe Quiet MSI Installation with Installer Arguments
id: 765c2056-a84d-4e51-b104-e30c3ced7e6f
status: test
description: This rule identifies process creation events where msiexec.exe is launched with silent/quiet behavior and MSI installer-related arguments (-i, -package, -a, -j) including the -q flag. Attackers may use msiexec.exe to run installer packages covertly while reducing user visibility and blending into legitimate installation workflows. The detection relies on Windows process creation telemetry, matching the msiexec.exe image/original filename and parsing the command line for the presence of specific installer switches.
references:
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md
- https://twitter.com/_st0pp3r_/status/1583914244344799235
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_msiexec_install_quiet.yml
author: frack113, Huntrule Team
date: 2022-01-16
modified: 2026-07-28
tags:
- attack.stealth
- attack.t1218.007
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \msiexec.exe
- OriginalFileName: msiexec.exe
selection_cli:
CommandLine|contains|windash:
- -i
- -package
- -a
- -j
selection_quiet:
CommandLine|contains|windash: -q
filter_main_system_temp:
ParentImage|startswith: C:\Windows\Temp\
filter_main_ccm:
ParentImage: C:\Windows\CCM\Ccm32BitLauncher.exe
IntegrityLevel:
- System
- S-1-16-16384
filter_optional_user_temp:
ParentImage|startswith: C:\Users\
ParentImage|contains: \AppData\Local\Temp\
filter_optional_wsl:
ParentImage|endswith: C:\Windows\System32\wsl.exe
Image|endswith: C:\Windows\System32\msiexec.exe
condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- WindowsApps installing updates via the quiet flag
level: medium
license: DRL-1.1
related:
- id: 79a87aa6-e4bd-42fc-a5bb-5e6fbdcd62f5
type: derived