Suspicious MsiExec Embedding Parent

Title: Suspicious MsiExec Embedding Parent
Status: test
Description:Adversaries may abuse msiexec.exe to proxy the execution of malicious payloads
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md
Author: frack113
Date: 2022-04-16
modified:2022-07-14
Tags:

• -'attack.stealth'
• -'attack.t1218.007'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection:
    Image|endswith:
      -'\powershell.exe'
      -'\pwsh.exe'
      -'\cmd.exe'

    ParentCommandLine|contains|all:
      -'MsiExec.exe'
      -'-Embedding '

  filter_splunk_ufw:
    Image|endswith: ':\Windows\System32\cmd.exe'
    CommandLine|contains: 'C:\Program Files\SplunkUniversalForwarder\bin\'
  filter_vs:
CommandLine|contains:'\DismFoDInstall.cmd'     - ParentCommandLine|contains|all:
      - '\MsiExec.exe -Embedding '
      - 'Global\MSI0000'
  condition:selection and not 1 of filter*
Falsepositives:
  -Unknown
Level: medium