PowerShell WMI Win32_Product MSI Installation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•19

Detects the execution of an MSI file using PowerShell and the WMI Win32_Product class. This method can be used for defense evasion by leveraging a trusted system utility (PowerShell) and a legitimate WMI class to install software, potentially bypassing traditional application whitelisting or execution policies.