Escrita Anômala em TempPackages por Processo Não-Installer

Renata Cardoso@rcardososec

•updated Jul 8, 2026•0•0•1

This rule detects registry value updates within the 'Microsoft\Windows\CurrentVersion\Installer\TempPackages' hive by processes other than standard Windows Installer-related binaries (e.g., msiexec.exe, TrustedInstaller.exe, or TiWorker.exe). Modification of this registry location by unauthorized processes may indicate an attempt to interfere with package installation, potential persistence, or defense evasion activities.