huntrule

Windows MsiInstaller installs remote MSI from web URLs (EventID 1040/1042)

Flags Windows Installer MsiInstaller events that indicate downloading and installing an MSI from a URL.

FreeReviewedSigma · Medium · v2
Product
windows
Service
application
Author
Stamatis Chatzimangou (SigmaHQ), DRL 1.1
Published
2022-10-23
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows Installer activity where the MsiInstaller provider is involved and the event contains a URL-like string ("//"). Remote MSI installations can be used to deliver and execute additional payloads or perform stealthy software deployment. It relies on Windows application logs with EventID 1040 or 1042 and the presence of web-style URI content in the recorded event data.

Reporting behind it

Related detections9 linkedT1218.007 — drag to rearrange
Malicious Msiexec Execution of Staged Update Package via Process Creation
Msiexec Spawning Batch Script Child Process
Possible PurpleFox MSHTA to Msiexec Remote MSI Chain
Suspicious Cabinet Extraction of Masqueraded vstm Archive via extrac32
Malicious Remote MSI Execution with Image Extension via msiexec (via process_creation)
Suspicious Raspberry Robin Msiexec Spawning a Proxy Binary (via process_creation)
Malicious DLL Execution via Wuauclt Update Handler (via process_creation)
Malicious Msiexec Installation of a Remote MSI Package (via process_creation)
Malicious aspnet_compiler.exe Injection Host Spawned by PowerShell via process_creation
Windows MsiInstaller installs remote MSI from web URLs (EventID 1040/1042)
Pivot detection · T1218.007 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.