StrikeShark Msiexec Proxy Execution - Suspicious Install Source or Child Process
Detects the abuse of msiexec.exe to execute malicious payloads, a technique observed in the StrikeShark campaign. The rule identifies suspicious child processes, installation from remote sources (UNC/HTTP), execution from non-standard user-writable directories (Temp, AppData), and the use of quiet installation flags to mask malicious activity.
Sigma
