Hayabusa medium test sigma

Msiexec Quiet Installation

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)

View Source

Detection Logic

{
  "process_creation": {
    "EventID": 1,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection_img": [
    {
      "Image
| endswith": "\\msiexec.exe"
    },
    {
      "OriginalFileName": "msiexec.exe"
    }
  ],
  "selection_cli": {
    "CommandLine
| contains
| windash": [
      "-i",
      "-package",
      "-a",
      "-j"
    ]
  },
  "selection_quiet": {
    "CommandLine
| contains
| windash": "-q"
  },
  "filter_main_system_temp": {
    "ParentImage
| startswith": "C:\\Windows\\Temp\\"
  },
  "filter_main_ccm": {
    "ParentImage": "C:\\Windows\\CCM\\Ccm32BitLauncher.exe",
    "IntegrityLevel": [
      "System",
      "S-1-16-16384"
    ]
  },
  "filter_optional_user_temp": {
    "ParentImage
| startswith": "C:\\Users\\",
    "ParentImage
| contains": "\\AppData\\Local\\Temp\\"
  },
  "filter_optional_wsl": {
    "ParentImage
| endswith": "C:\\Windows\\System32\\wsl.exe",
    "Image
| endswith": "C:\\Windows\\System32\\msiexec.exe"
  },
  "condition": "process_creation and (all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*)"
}

False Positives

⚠ WindowsApps installing updates via the quiet flag

Field Validations

Loading…

Comments (0)

Loading comments...