Msiexec Executes an MSI Package from ProgramData

Luís Marques@remotecodeexecution

•updated Jul 24, 2026•2•0•2

Detects Windows Installer executing an MSI package from ProgramData, matching the msaRAT delivery chain in which update_ms.msi is downloaded to that directory and then executed.