Msiexec.EXE Initiated Network Connection Over HTTP/HTTPS

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•2•0•33

Detects a network connection initiated by an "Msiexec.exe" process over port 80 or 443. Adversaries might abuse "msiexec.exe" to install and execute remotely hosted packages. This rule helps hunt for potentially anomalous or suspicious communications.