Sagan unknown stable other

[WINDOWS-APPLICATION] MsiInstaller Installer Exited for SentinelInstaller (3/5)

[WINDOWS-APPLICATION] MsiInstaller Installer Exited for SentinelInstaller (3/5)

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-APPLICATION] MsiInstaller Installer Exited for SentinelInstaller (3/5)"; program:*Application*; event_id:1042; content:"MsiInstaller"; nocase; content:"SentinelOneInstaller"; nocase; parse_src_ip:1; normalize; reference:url,https://www.aon.com/en/insights/cyber-labs/bring-your-own-installer-bypassing-sentinelone; classtype:execution; sid:5015961; rev:1; metadata:created_at 2025_05_07, updated_at 2025_05_07, mitre_tactic_id TA0002, mitre_technique_id T1203;)

Field Validations

Loading…

Comments (0)

Loading comments...