Suspicious Msiexec Execute Arbitrary DLL
This rule detects suspicious execution of msiexec.exe with the '-y' or '/y' flag, which can be abused to execute arbitrary DLLs. Adversaries may use this technique to bypass application control or proxy execution of malicious payloads. The rule filters out known legitimate uses by Apple Bonjour and Apple Software Update, as well as Microsoft System Center Configuration Manager (SCCM).
Sigma
