MsiExec Web Install
Detects suspicious execution of msiexec.exe with web addresses as parameters, which can be indicative of an adversary attempting to download and execute malicious MSI packages or DLLs directly from a remote source. This technique is often used for defense evasion and ingress tool transfer.
Sigma
