Windows Process Creation: msiexec.exe Embedding Spawned by PowerShell/cmd/pwsh
Alerts when cmd/powershell launches msiexec.exe with -Embedding, a proxy execution pattern.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-04-16
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation where a PowerShell, pwsh, or cmd parent process launches msiexec.exe in embedding mode (using the -Embedding argument). Attackers may abuse msiexec.exe as a proxy to run malicious payloads while blending into legitimate Windows tooling and installer-related execution patterns. The detection relies on Windows process creation telemetry, specifically process image paths and parent command line contents.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: msiexec.exe Embedding Spawned by PowerShell/cmd/pwsh"
id: 594f81a0-7d36-401b-aafd-f2d98c9a207c
status: test
description: This rule flags process creation where a PowerShell, pwsh, or cmd parent process launches msiexec.exe in embedding mode (using the -Embedding argument). Attackers may abuse msiexec.exe as a proxy to run malicious payloads while blending into legitimate Windows tooling and installer-related execution patterns. The detection relies on Windows process creation telemetry, specifically process image paths and parent command line contents.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_msiexec_embedding.yml
author: frack113, Huntrule Team
date: 2022-04-16
modified: 2022-07-14
tags:
- attack.stealth
- attack.t1218.007
logsource:
product: windows
category: process_creation
detection:
selection:
Image|endswith:
- \powershell.exe
- \pwsh.exe
- \cmd.exe
ParentCommandLine|contains|all:
- MsiExec.exe
- "-Embedding "
filter_splunk_ufw:
Image|endswith: :\Windows\System32\cmd.exe
CommandLine|contains: C:\Program Files\SplunkUniversalForwarder\bin\
filter_vs:
- CommandLine|contains: \DismFoDInstall.cmd
- ParentCommandLine|contains|all:
- "\\MsiExec.exe -Embedding "
- Global\MSI0000
condition: selection and not 1 of filter*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 4a2a2c3e-209f-4d01-b513-4155a540b469
type: derived