Trojanized ManageEngine OpManager MSI Installer Execution
This rule detects the execution of potential trojanized ManageEngine OpManager MSI installer files (ManageEngine-OpManager.msi or opmanager.msi) by msiexec.exe when initiated by processes other than standard system binaries like explorer.exe, svchost.exe, or msiexec.exe itself. This behavior is indicative of an attacker attempting to execute a malicious installer package, which may be part of a supply chain compromise or an attempt to install a malicious payload masquerading as legitimate software.
Microsoft Sentinel (KQL)
