msiexec.exe deletes C:\Config.Msi folder as SYSTEM (CVE-2025-27727)
Detects instances where the Windows Installer process (msiexec.exe) deletes files or folders associated with the 'Config.Msi' directory while running in the context of the SYSTEM account (SID S-1-5-18). Config.Msi is used by Windows Installer for rollback information during installations or updates; unauthorized or suspicious deletions from this location, particularly when initiated by system-level processes, may indicate attempts to hide installation artifacts or manipulate the installer service.
Microsoft Sentinel (KQL)
