Correlated TempPackages registry write and Config.Msi .rbs/.rbf tampering by non-installer process (CVE-2025-27727)
Detects unauthorized processes (non-msiexec.exe) modifying registry keys related to TempPackages alongside simultaneous modification or interaction with .rbs or .rbf files located within the C:\Config.Msi directory. This behavior is indicative of potential MSI installer hijacking or tampering attempts where an adversary attempts to bypass standard installer execution paths.
Microsoft Sentinel (KQL)
