Msiexec Elevado Deletando Arquivos Fora dos Padrões em Config.Msi

Renata Cardoso@rcardososec

•updated Jul 8, 2026•2•1•9

Detects instances where the msiexec.exe process, running under the local system account (S-1-5-18), deletes files located within the 'C:\Config\.Msi' directory. This behavior is often associated with the misuse of the Windows Installer service or exploitation techniques intended to leverage system-level file operations for privilege escalation or persistence.