MSI Installation From Web

Title: MSI Installation From Web
Status: test
Description:Detects installation of a remote msi file from web.
References:
  -https://twitter.com/_st0pp3r_/status/1583922009842802689
Author: Stamatis Chatzimangou
Date: 2022-10-23
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1218'
• -'attack.t1218.007'

Logsource:

• product: windows
• service: application

Detection:
  selection:
    Provider_Name: 'MsiInstaller'
    EventID:
      -'1040'
      -'1042'

    Data|contains: '://'
  condition:selection
Falsepositives:
  -Unknown
Level: medium