cURL Downloaded MSI Followed by Silent Installation
Detects a command shell using cURL to download an MSI package and immediately install it silently with msiexec, matching a reported RMM delivery workflow. This rule specifically looks for command-line executions involving 'cmd.exe', 'powershell.exe', or 'pwsh.exe' that use 'curl' to download a '.msi' file and then execute 'msiexec' with silent installation flags.
Microsoft Sentinel (KQL)
