msiexec.exe LOLBin Abuse — Remote URL, UNC, Temp Path, or /z /x

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•0

This rule detects potentially malicious use of the Windows Installer binary (msiexec.exe) by monitoring for command-line arguments involving remote network resources (HTTP/HTTPS/UNC paths) or suspicious local directories (Temp, AppData, Downloads). Such patterns are indicative of living-off-the-land techniques used to proxy execution, download and install payloads, or perform silent/unauthorized software installations.