Non-installer process modifies Config.Msi ACL via WRITE_DAC/NtSetSecurityObject (CVE-2025-27727)

Emiliano Mema@Nosalva

•updated Jul 22, 2026•0•0•6

This rule detects unauthorized attempts to modify the security descriptor, access control lists (ACLs), or security settings of the 'C:\Config.Msi' directory. This directory is used by the Windows Installer (msiexec.exe) for temporary operations; attackers often target this location by modifying permissions to gain persistent access, hide malicious payloads, or execute arbitrary code with elevated privileges.