StrikeShark msiexec.exe Proxy Execution Spawning Unexpected Child Processes

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

This rule detects potentially malicious usage of msiexec.exe. It monitors for two primary suspicious behaviors: 1) msiexec.exe spawning common command-line or scripting interpreters such as cmd.exe, powershell.exe, or mshta.exe, which often indicates lateral movement or execution of malicious payloads; and 2) msiexec.exe executing an installation process with silent or quiet command-line flags, which may be used to hide malicious software installation from the user.