Non-installer process calls ReadDirectoryChangesW on C:\Config.Msi (CVE-2025-27727)

Emiliano Mema@Nosalva

•updated Jul 22, 2026•0•0•5

Detects instances where a process other than msiexec.exe performs directory change operations (ReadDirectoryChangesW) within the 'C:\Config.Msi' folder. This path is often used by the Windows Installer, and unauthorized access to this directory can indicate suspicious activity related to DLL sideloading or persistence mechanisms.