Windows Process Creation Indicators for PowerShell MSI Download and Silent Install (PaperCut MF/NG)
Detects hidden PowerShell downloading a setup.msi and silent msiexec installation tied to PaperCut MF/NG exploitation indicators.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-04-25
- Updated
- 2026-07-31
What it detects
This rule identifies Windows process creation activity where PowerShell is invoked with hidden/no-profile execution to download a MSI via Invoke-WebRequest and save it to setup.msi. It further matches msiexec running a silent installation of the same MSI with a specific IntegratorLogin parameter. These behaviors matter because they align with automated exploitation chains that stage and install attacker-controlled components with minimal user visibility. The detection relies on process creation telemetry with full command-line arguments, including PowerShell and msiexec command parameters.
Reporting behind it
- huntress.comhttps://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software
- papercut.comhttps://www.papercut.com/kb/Main/PO-1216-and-PO-1219
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/PaperCut-Print-Management-Exploitation/proc_creation_win_papercut_print_management_exploitation_indicators.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Process Creation Indicators for PowerShell MSI Download and Silent Install (PaperCut MF/NG)
id: 9b1fa746-0c4d-4abf-8645-487e9cce7736
status: test
description: This rule identifies Windows process creation activity where PowerShell is invoked with hidden/no-profile execution to download a MSI via Invoke-WebRequest and save it to setup.msi. It further matches msiexec running a silent installation of the same MSI with a specific IntegratorLogin parameter. These behaviors matter because they align with automated exploitation chains that stage and install attacker-controlled components with minimal user visibility. The detection relies on process creation telemetry with full command-line arguments, including PowerShell and msiexec command parameters.
references:
- https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software
- https://www.papercut.com/kb/Main/PO-1216-and-PO-1219
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/PaperCut-Print-Management-Exploitation/proc_creation_win_papercut_print_management_exploitation_indicators.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-25
tags:
- attack.execution
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_1:
CommandLine|contains|all:
- " /c "
- powershell
- -nop -w hidden
- Invoke-WebRequest
- setup.msi
- -OutFile
selection_2:
CommandLine|contains|all:
- "msiexec "
- "/i "
- "setup.msi "
- "/qn "
- IntegratorLogin=fimaribahundq
condition: 1 of selection_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: de1bd0b6-6d59-417c-86d9-a44114aede3b
type: derived