PowerShell stager spawning silent msiexec install of GUID-prefixed MSI from %TEM

ills3c Intel&Coffee@Ills3C

•updated yesterday•3•0•6

Detects behavior where PowerShell or pwsh executes msiexec.exe to silently install an MSI file located in a temporary directory with a GUID-prefixed filename, optionally following a recent download from a remote URL.