TempPackages registry write with REG_DWORD 0x2 from non-SYSTEM msiexec.exe context (CVE-2025-27727)
Detects instances where the Windows Installer process (msiexec.exe) performs registry modifications (Value Set or Key Creation) within the 'Software\Microsoft\Windows\CurrentVersion\Installer\TempPackages' hive by a non-system user. This activity is indicative of potential malicious installer manipulation or persistence mechanisms involving MSI installers.
Microsoft Sentinel (KQL)
