Windows msiexec.exe Quiet MSI Installation with Installer Arguments

title: Windows msiexec.exe Quiet MSI Installation with Installer Arguments
id: 765c2056-a84d-4e51-b104-e30c3ced7e6f
status: test
description: This rule identifies process creation events where msiexec.exe is launched with silent/quiet behavior and MSI installer-related arguments (-i, -package, -a, -j) including the -q flag. Attackers may use msiexec.exe to run installer packages covertly while reducing user visibility and blending into legitimate installation workflows. The detection relies on Windows process creation telemetry, matching the msiexec.exe image/original filename and parsing the command line for the presence of specific installer switches.
references:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md
  - https://twitter.com/_st0pp3r_/status/1583914244344799235
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_msiexec_install_quiet.yml
author: frack113, Huntrule Team
date: 2022-01-16
modified: 2026-07-28
tags:
  - attack.stealth
  - attack.t1218.007
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \msiexec.exe
    - OriginalFileName: msiexec.exe
  selection_cli:
    CommandLine|contains|windash:
      - -i
      - -package
      - -a
      - -j
  selection_quiet:
    CommandLine|contains|windash: -q
  filter_main_system_temp:
    ParentImage|startswith: C:\Windows\Temp\
  filter_main_ccm:
    ParentImage: C:\Windows\CCM\Ccm32BitLauncher.exe
    IntegrityLevel:
      - System
      - S-1-16-16384
  filter_optional_user_temp:
    ParentImage|startswith: C:\Users\
    ParentImage|contains: \AppData\Local\Temp\
  filter_optional_wsl:
    ParentImage|endswith: C:\Windows\System32\wsl.exe
    Image|endswith: C:\Windows\System32\msiexec.exe
  condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - WindowsApps installing updates via the quiet flag
level: medium
license: DRL-1.1
related:
  - id: 79a87aa6-e4bd-42fc-a5bb-5e6fbdcd62f5
    type: derived