MSIExec Remote MSI Payload Execution via HTTP or UNC Path
Detects the execution of msiexec.exe where the command line points to a remote resource via HTTP, HTTPS, or a UNC path. This behavior is indicative of an adversary using msiexec to download and execute a malicious MSI package, leveraging it as a proxy for malicious code execution.
SentinelOne
