Non-msiexec process writes/overwrites .rbs rollback script in C:\Config.Msi (CVE-2025-27727)

Emiliano Mema@Nosalva

•updated Jul 22, 2026•0•0•3

Detects file creation, modification, or renaming operations involving .rbs or .rbf files within the 'C:\Config.Msi' directory when the process performing the action is not 'msiexec.exe'. Adversaries may attempt to manipulate MSI rollback or installation files to achieve persistence or execute arbitrary code during the installation process.