StrikeShark msiexec T1218.007 Remote/Writable-Path Load with Suspicious Child

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•6

Detects the abuse of msiexec.exe to perform suspicious actions such as fetching payloads from remote URLs, UNC paths, or loading from user-writable directories (e.g., AppData, Temp, ProgramData). The rule further correlates this with msiexec spawning suspicious child processes (e.g., cmd.exe, powershell.exe, wscript.exe), which is indicative of malicious post-exploitation activity.