msiexec.exe elevation abuse via CElevate/CleanupTempPackages/FDeleteFolder (CVE-2025-27727)

Emiliano Mema@Nosalva

•updated Jul 22, 2026•4•0•15

This rule detects execution of msiexec.exe involving specific internal method calls ('CElevate', 'CleanupTempPackages', 'FDeleteFolder'). These calls are associated with abusing the Windows Installer elevation mechanism to perform folder deletion with SYSTEM-level privileges.