Suspicious MsiExec Embedding Parent for Script Execution
This rule detects suspicious execution of PowerShell or Command Prompt (cmd.exe) processes where the parent process is MsiExec.exe and the command line contains '-Embedding'. This behavior is often abused by adversaries to proxy the execution of malicious payloads, leveraging msiexec.exe as a trusted binary to bypass application controls.
Sigma
