marker.txt moved into C:\Config.Msi as .rbf rollback file (CVE-2025-27727)

Emiliano Mema@Nosalva

•updated Jul 22, 2026•1•0•6

Detects the creation or renaming of .rbf (Rollback File) files within the C:\Config.Msi directory where the previous filename was 'marker.txt'. This behavior is associated with the Windows Installer service (msiexec.exe) and can be leveraged by adversaries to perform file operations or execute arbitrary code during installation processes.