CVE-2025-27727: SYSTEM msiexec.exe deletes C:\Config.Msi after non-installer TempPackages registry write

Renata Cardoso@rcardososec

•updated Jul 8, 2026•17•2•28

Detects a suspicious sequence of events where a non-standard process writes to the Windows Installer TempPackages registry key, followed by the msiexec.exe process running as SYSTEM deleting the C:\Config.Msi folder. This behavior is indicative of potential privilege escalation or exploitation, such as CVE-2025-27727, where an attacker leverages msiexec's high-privilege context to perform unauthorized file operations.