PowerShell MSI Install via WindowsInstaller COM From Remote Location

SigmaHQ Detections@sigmaHQ

•updated Jun 25, 2025•0•13

Detects the execution of PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`) hosted remotely. This could be an indication of malicious software deployment or lateral movement attempts using Windows Installer functionality. The usage of the WindowsInstaller COM object rather than msiexec could be an attempt to bypass detection.