Msiexec Quiet Installation
This rule detects the execution of msiexec.exe with command-line arguments indicative of a quiet installation. Adversaries often abuse msiexec.exe, the Windows Installer command-line utility, to proxy the execution of malicious payloads. The rule specifically looks for msiexec.exe being executed with installation-related flags such as '-i', '-package', '-a', or '-j', combined with the quiet installation flag '-q'. It filters out common legitimate scenarios where msiexec.exe might be used in temporary user or system directories, or by the System Center Configuration Manager (SCCM).
Sigma
