Potential MsiExec Masquerading

Title: Potential MsiExec Masquerading
Status: test
Description:Detects the execution of msiexec.exe from an uncommon directory
References:
  -https://twitter.com/200_okay_/status/1194765831911215104
Author: Florian Roth (Nextron Systems)
Date: 2019-11-14
modified:2023-02-21
Tags:

• -'attack.stealth'
• -'attack.t1036.005'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
Image|endswith:'\msiexec.exe' OriginalFileName:'\msiexec.exe'   filter:
    Image|startswith:
      -'C:\Windows\System32\'
      -'C:\Windows\SysWOW64\'
      -'C:\Windows\WinSxS\'

  condition:selection and not filter
Falsepositives:
  -Unknown
Level: high