Windows Process Creation: msiexec.exe Embedding Spawned by PowerShell/cmd/pwsh

title: "Windows Process Creation: msiexec.exe Embedding Spawned by PowerShell/cmd/pwsh"
id: 594f81a0-7d36-401b-aafd-f2d98c9a207c
status: test
description: This rule flags process creation where a PowerShell, pwsh, or cmd parent process launches msiexec.exe in embedding mode (using the -Embedding argument). Attackers may abuse msiexec.exe as a proxy to run malicious payloads while blending into legitimate Windows tooling and installer-related execution patterns. The detection relies on Windows process creation telemetry, specifically process image paths and parent command line contents.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_msiexec_embedding.yml
author: frack113, Huntrule Team
date: 2022-04-16
modified: 2022-07-14
tags:
  - attack.stealth
  - attack.t1218.007
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith:
      - \powershell.exe
      - \pwsh.exe
      - \cmd.exe
    ParentCommandLine|contains|all:
      - MsiExec.exe
      - "-Embedding "
  filter_splunk_ufw:
    Image|endswith: :\Windows\System32\cmd.exe
    CommandLine|contains: C:\Program Files\SplunkUniversalForwarder\bin\
  filter_vs:
    - CommandLine|contains: \DismFoDInstall.cmd
    - ParentCommandLine|contains|all:
        - "\\MsiExec.exe -Embedding "
        - Global\MSI0000
  condition: selection and not 1 of filter*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 4a2a2c3e-209f-4d01-b513-4155a540b469
    type: derived