Arbitrary MSI Download Via Devinit.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects the use of "devinit.exe" with specific command-line arguments to download arbitrary MSI packages. This technique can be abused as a Living Off The Land Binary (LOLBIN) to perform malicious downloads on a Windows system.