Browser Downloaded MSI Followed by Silent msiexec Execution

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•0•0•8

Correlates an MSI downloaded by a browser with silent msiexec execution on the same device within fifteen minutes. This rule detects potential malicious software installation initiated by a user downloading an MSI package via a web browser, followed by a silent execution of that package using msiexec.exe. This technique is often used by attackers to install malware without user interaction.