MSI Custom Action Loads Embedded lib.dll via msiexec.exe

Luís Marques@remotecodeexecution

•updated today•0•0•0

Detects lib.dll being loaded by msiexec.exe, an unusual image-load relationship that matches the embedded MSI custom action used by msaRAT.