Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
1
1
1
1
Platforms
1
Products / Services
1
MITRE Techniques
1
1
1
1
CVEs
71
71
64
58
49
Detects a suspicious sequence of events where a non-standard process writes to the Windows Installer TempPackages registry key, followed by the msiexec.exe process running as SYSTEM deleting the C:\Config.Msi folder. This behavior is indicative of potential privilege escalation or exploitation, such as CVE-2025-27727, where an attacker leverages msiexec's high-privilege context to perform unauthorized file operations.
