MSI-backed loader execution chain
This query uses the process ID of each child to match the parent process's PID, then reconstructs the chain back to explorer.exe. It also checks for the encoded PowerShell, silent MSI installation, and embedded MSI execution behaviours described in the source article. Important caveats - Causality scope: This finds matching process events within a shared causality ID; it does not establish that each process directly launched the next. - Explorer root: The root process may not share the same causality ID in every telemetry scenario. If this join removes otherwise valid results, investigate the root separately. - Strict matching: Requiring every stage will miss partial chains and variants with different command-line arguments. Consider separate alerts for the encoded PowerShell and silent MSI behaviours. - Validation: Confirm the field names, join syntax, and causality-ID population against your tenant before deploying this as a production detection.
Cortex XDR
