huntrule

Windows msiexec Process Creation With Web URL Parameters

Alerts when msiexec is launched with command-line web URL indicators in its parameters.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2018-02-09
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Defense Evasion → C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags newly created msiexec processes whose command line contains both an msiexec invocation and a web URL indicator (" ://"), suggesting installation content referenced via network locations. Attackers may use msiexec to run installation packages from remote sources to blend execution with legitimate Windows behavior. The detection relies on Windows process creation telemetry capturing the full command line of the spawned msiexec process.

Reporting behind it

Related detections9 linkedT1105 — drag to rearrange
Possible PurpleFox MSHTA to Msiexec Remote MSI Chain
Malicious Remote MSI Execution with Image Extension via msiexec (via process_creation)
Suspicious Msiexec Remote Package Installation from URL via Process Creation
Masquerading Bumblebee Loader MSI Download via PowerShell Invoke-WebRequest and Silent msiexec (via process_creation)
Suspicious PowerShell Remote Download and Execution via Invoke-WebRequest
Suspicious File Download to Shared Memory Directory on Linux
Malicious axios NPM Supply Chain C2 Domain Resolution
Suspicious Curl Download From Sysinternals Live Service (via process_creation)
Suspicious Remote Script Transfer via Bitsadmin (via process_creation)
Windows msiexec Process Creation With Web URL Parameters
Pivot detection · T1105 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.