CVE-2021-44077 POC Default Dropped File
This rule detects the creation of an executable file named "msiexec.exe" within the 'bin' directory of a ManageEngine SupportCenter Plus installation. This specific file creation pattern is associated with the exploitation of CVE-2021-44077, a vulnerability for which public Proof-of-Concept (POC) exploits are available. The presence of a newly created 'msiexec.exe' in this non-standard location within the application's directory indicates potential compromise and malicious activity, as legitimate 'msiexec.exe' is a system binary typically located in system directories.
Sigma
