Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
302 detections
Filters
Last updated
All Time
Detection languages
138
85
23
18
14
Contributors
73
46
31
30
20
Categories
248
129
57
47
36
Platforms
300
1
1
1
1
Products / Services
112
93
59
20
8
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
2
1
1
1
1
IDS Classtypes
3
IDS Protocols
3
This rule detects suspicious child processes spawned by 'WsusService.exe', which is indicative of successful exploitation of a vulnerability like CVE-2025-59287. The rule specifically looks for the WSUS service initiating common command-line utilities such as cmd.exe, powershell.exe, curl.exe, wget.exe, certutil.exe, bitsadmin.exe, and msiexec.exe, which are often used for post-exploitation activities like command execution, downloading additional payloads, or system manipulation. The severity is dynamically assigned based on the spawned process, with download utilities like curl.exe, certutil.exe, and bitsadmin.exe being flagged as 'Critical'.
This rule detects the execution of msiexec.exe from cmd.exe with command-line arguments indicating a silent installation of a remote MSI package over HTTP or HTTPS. This behavior is indicative of post-exploitation activity, specifically observed in the context of SolarWinds Web Help Desk (WHD) exploitation where attackers use msiexec to download and install malicious payloads.
Detects when a Remote Monitoring and Management (RMM) tool or a known lure spawns 'msiexec.exe' to download and execute a remote installer. This behavior is often abused by threat actors to deploy secondary payloads like additional C2 tools, leveraging legitimate RMM functionality.
Detects when a known Remote Monitoring and Management (RMM) tool is used to install a secondary RMM tool. Threat actors use this technique to establish redundant and persistent access to victim networks.
Detects ScreenConnect/ConnectWise Control malware installer MSI and components
Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.
Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)
Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)
Detects the use of msiexec.exe to remotely download and execute an MSI package, which then spawns an encoded PowerShell command. This TTP is associated with NetSupport RAT loaders.
Detects instances where the Windows Installer service (msiexec.exe) spawns command-line interpreters like cmd.exe or PowerShell.exe. This behavior is often associated with the 'AlwaysInstallElevated' policy being enabled, which can lead to privilege escalation.
Detects the Windows Installer service (msiexec.exe) attempting to install MSI packages with SYSTEM privileges, which can be indicative of privilege escalation through the 'AlwaysInstallElevated' policy.
The following analytic detects MSIExec making network connections over ports 443 or 80. This behavior is identified by correlating process creation events from Endpoint Detection and Response (EDR) agents with network traffic logs. Typically, MSIExec does not perform network communication to the internet, making this activity unusual and potentially indicative of malicious behavior. If confirmed malicious, an attacker could be using MSIExec to download or communicate with external servers, potentially leading to data exfiltration, command and control (C2) communication, or further malware deployment.
Detects the usage of msiexec.exe to perform a quiet installation of a package from a remote location (either HTTP/HTTPS or a UNC path). This behavior is often associated with malware distribution, including the Raspberry Robin worm, to evade detection and establish persistence.
Detects the creation of suspicious child processes, such as common scripting or living-off-the-land binaries (LOLBINs), originating from applications located within the WindowsApps directory. This activity could indicate the execution of malicious '.appx' packages or other forms of code execution from an unexpected and potentially untrusted source.
The analytic detects the use of msiexec.exe with an HTTP or HTTPS URL in the command line, indicating a remote file download attempt. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant as it may indicate an attempt to download and execute potentially malicious software from a remote server. If confirmed malicious, this could lead to unauthorized code execution, system compromise, or further malware deployment within the network.
Detects hard IoCs and activity associated with a trojanized installer of Velociraptor incident response tool making callbacks to C2 domains from workers[.]dev and tunneling with Visual Studio Code (code.exe). The detection looks for the creation of hard IoCs from this malicious Velociraptor installer V2.msi, followed by network connections to known C2 domains and the execution of related processes, including PowerShell (with support for detecting encoded commands to install code.exe) and msiexec activity tied to malicious domains.
Detects the execution of LOLBins (msiexec.exe, mshta.exe) with command-line arguments to download or execute remote files, a technique used in the ShadowCaptcha campaign's initial access phase via fake CAPTCHA pages.
Detects the initial execution of the Raspberry Robin malware from an external drive. The rule specifically looks for `cmd.exe` as a parent process, executing a command containing `/r` and ending with specific file extensions (like .bin, .ico, .lnk, .lo, .sv, .usb), which then launches `msiexec.exe` with `/q` and a URL (http: or https:). This pattern is indicative of Raspberry Robin's initial infection vector.
This rule detects the execution of msiexec.exe attempting to load a DLL and call its DllUnregisterServer function. This behavior is often abused by adversaries for defense evasion and proxy execution, as msiexec.exe is a legitimate Windows utility. The detection specifically looks for msiexec.exe being executed with the '-z' flag and a command line containing '.dll', indicating an attempt to unregister a DLL.
This rule detects suspicious execution of msiexec.exe with the '-y' or '/y' flag, which can be abused to execute arbitrary DLLs. Adversaries may use this technique to bypass application control or proxy execution of malicious payloads. The rule filters out known legitimate uses by Apple Bonjour and Apple Software Update, as well as Microsoft System Center Configuration Manager (SCCM).
This rule detects the execution of msiexec.exe with command-line arguments indicative of a quiet installation. Adversaries often abuse msiexec.exe, the Windows Installer command-line utility, to proxy the execution of malicious payloads. The rule specifically looks for msiexec.exe being executed with installation-related flags such as '-i', '-package', '-a', or '-j', combined with the quiet installation flag '-q'. It filters out common legitimate scenarios where msiexec.exe might be used in temporary user or system directories, or by the System Center Configuration Manager (SCCM).
This detection identifies suspicious use of the Windows RunMRU registry key — typically used by Explorer to store command history — to execute .msi installer files. It specifically flags cases where a registry value under the RunMRU key contains a reference to a .msi file, which can indicate abuse by malware droppers such as LegionLoader.
Detects suspicious commands written to the RunMRU registry key. This is a characteristic of the "ClickFix" social engineering technique, where a user is tricked into copying a malicious command and executing it via the Windows Run dialog (Win+R). This technique is notably used by Lumma Stealer affiliates.
Page 12 of 15