Windows: Suspicious msiexec.exe Command-Line Writes Install Logs with /Y

Alerts on suspicious msiexec.exe executions using the /Y argument that are not consistent with common installer locations.

FreeReviewedSigma · Medium · v1

Product: windows
Category: process_creation
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2022-01-16
Updated: 2026-07-30

Analysis Detection

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1218.007Msiexec
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation where msiexec.exe is launched with a command line containing " /Y", which can be used to direct installer-related output to an attacker-controlled location. Such proxy execution behavior matters because it can help adversaries run or stage payloads through a trusted Windows utility. The detection relies on Windows process creation telemetry, matching the msiexec.exe image path suffix and the presence of the /Y argument while excluding common legitimate paths.

Reporting behind it

Related detections9 linkedT1218.007 — drag to rearrange

Malicious Msiexec Execution of Staged Update Package via Process Creation

Msiexec Spawning Batch Script Child Process

Possible PurpleFox MSHTA to Msiexec Remote MSI Chain

Malicious Remote MSI Execution with Image Extension via msiexec (via process_creation)

Suspicious Raspberry Robin Msiexec Spawning a Proxy Binary (via process_creation)

Malicious Msiexec Installation of a Remote MSI Package (via process_creation)

Suspicious msiexec Remote Package Installation over HTTP

Malicious MSI Installation from Remote WebDAV Share via process_creation

Suspicious Msiexec Remote Package Installation from URL via Process Creation

Windows: Suspicious msiexec.exe Command-Line Writes Install Logs with /Y

Pivot detection · T1218.007 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-suspicious-msiexec-exe-command-line-writes-install-logs-with-y-6f4191bb

title: "Windows: Suspicious msiexec.exe Command-Line Writes Install Logs with /Y"
id: 2a32c46d-745f-4235-8df4-17cfd4a118d5
status: test
description: This rule flags process creation where msiexec.exe is launched with a command line containing " /Y", which can be used to direct installer-related output to an attacker-controlled location. Such proxy execution behavior matters because it can help adversaries run or stage payloads through a trusted Windows utility. The detection relies on Windows process creation telemetry, matching the msiexec.exe image path suffix and the presence of the /Y argument while excluding common legitimate paths.
references:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md
  - https://twitter.com/_st0pp3r_/status/1583914515996897281
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_msiexec_execute_dll.yml
author: frack113, Huntrule Team
date: 2022-01-16
modified: 2026-01-09
tags:
  - attack.stealth
  - attack.t1218.007
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \msiexec.exe
    CommandLine|contains|windash: " /Y"
  filter_main_legit_path:
    CommandLine|contains:
      - \MsiExec.exe" /Y "C:\Program Files\
      - \MsiExec.exe" /Y "C:\Program Files (x86)\
      - \MsiExec.exe" /Y "C:\Windows\System32\
      - \MsiExec.exe" /Y "C:\Windows\SysWOW64\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legitimate script
level: medium
license: DRL-1.1
related:
  - id: 6f4191bb-912b-48a8-9ce7-682769541e6d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL