Execution via MsiExec DownloadAndExecute CustomAction

sequence with maxspan=1m
 [process where event.action == "start" and process.name : "rundll32.exe" and
  process.command_line : "*!CustomActions.DownloadAndExecute*"] by process.entity_id
 [dns where event.action == "lookup_requested" and
  process.name : "rundll32.exe" and dns.question.name : "?*"] by process.entity_id
 [process where event.action == "start" and process.parent.name : "rundll32.exe"] by process.parent.entity_id