Windows MsiInstaller installs a remote MSI from a URL

Flags Windows Installer MsiInstaller events that indicate downloading and installing an MSI from a URL.

FreeUnreviewedSigmamediumv1

windows-msiinstaller-installs-a-remote-msi-from-a-url-5594e67a

title: Windows MsiInstaller installs a remote MSI from a URL
id: 829f2f28-e82a-46d1-b285-76ba5e3d5593
status: test
description: This rule identifies Windows Installer activity where the MsiInstaller provider processes events 1040 or 1042 and the event data contains '://', indicating a URL-based MSI location. Attackers commonly use remote MSI retrieval to stealthily stage and execute software without manual local packaging. It relies on Windows application telemetry from the MsiInstaller provider and event IDs 1040 and 1042, plus a substring match on the event data.
references:
  - https://twitter.com/_st0pp3r_/status/1583922009842802689
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/msiinstaller/win_msi_install_from_web.yml
author: Stamatis Chatzimangou, Huntrule Team
date: 2022-10-23
tags:
  - attack.stealth
  - attack.t1218
  - attack.t1218.007
logsource:
  product: windows
  service: application
detection:
  selection:
    Provider_Name: MsiInstaller
    EventID:
      - 1040
      - 1042
    Data|contains: ://
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 5594e67a-7f92-4a04-b65d-1a42fd824a60
    type: derived

What it detects

This rule identifies Windows Installer activity where the MsiInstaller provider processes events 1040 or 1042 and the event data contains '://', indicating a URL-based MSI location. Attackers commonly use remote MSI retrieval to stealthily stage and execute software without manual local packaging. It relies on Windows application telemetry from the MsiInstaller provider and event IDs 1040 and 1042, plus a substring match on the event data.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.