Suspicious Msiexec Execute Arbitrary DLL

Severity: medium
Author: frack113
Source: upstream

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)

MITRE ATT&CK coverage

Tactic	Techniques
Defense Evasion	`T1218.007` System Binary Proxy Execution: Msiexec

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation
Security-Auditing	4688	A new process has been created.

Stages and Predicates

Stage 1: `selection`

CommandLine|contains: ' -y'
Image|endswith: '\msiexec.exe'

Stage 2: `not 1 of filter_apple`

or:
CommandLine|contains: '\MsiExec.exe" -Y C:\Windows\CCM\'
CommandLine|contains: '\MsiExec.exe" -Y "C:\Program Files (x86)\Apple Software Update\ScriptingObjectModel.dll'
CommandLine|contains: '\MsiExec.exe" -Y "C:\Program Files (x86)\Apple Software Update\SoftwareUpdateAdmin.dll'
CommandLine|contains: '\MsiExec.exe" -Y "C:\Program Files (x86)\Bonjour\mdnsNSP.dll'
CommandLine|contains: '\MsiExec.exe" -Y "C:\Program Files\Bonjour\mdnsNSP.dll'
CommandLine|contains: '\MsiExec.exe" -Y "C:\Windows\CCM\'
CommandLine|contains: '\MsiExec.exe" /Y C:\Windows\CCM\'
CommandLine|contains: '\MsiExec.exe" /Y "C:\Program Files (x86)\Apple Software Update\ScriptingObjectModel.dll'
CommandLine|contains: '\MsiExec.exe" /Y "C:\Program Files (x86)\Apple Software Update\SoftwareUpdateAdmin.dll'
CommandLine|contains: '\MsiExec.exe" /Y "C:\Program Files (x86)\Bonjour\mdnsNSP.dll'
CommandLine|contains: '\MsiExec.exe" /Y "C:\Program Files\Bonjour\mdnsNSP.dll'
CommandLine|contains: '\MsiExec.exe" /Y "C:\Windows\CCM\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`-y` `\MsiExec.exe" -Y "C:\Program Files (x86)\Apple Software Update\ScriptingObjectModel.dll` `\MsiExec.exe" -Y "C:\Program Files (x86)\Apple Software Update\SoftwareUpdateAdmin.dll` `\MsiExec.exe" -Y "C:\Program Files (x86)\Bonjour\mdnsNSP.dll` `\MsiExec.exe" -Y "C:\Program Files\Bonjour\mdnsNSP.dll` `\MsiExec.exe" -Y "C:\Windows\CCM\` `\MsiExec.exe" -Y C:\Windows\CCM\` `\MsiExec.exe" /Y "C:\Program Files (x86)\Apple Software Update\ScriptingObjectModel.dll` `\MsiExec.exe" /Y "C:\Program Files (x86)\Apple Software Update\SoftwareUpdateAdmin.dll` `\MsiExec.exe" /Y "C:\Program Files (x86)\Bonjour\mdnsNSP.dll` `\MsiExec.exe" /Y "C:\Program Files\Bonjour\mdnsNSP.dll` `\MsiExec.exe" /Y "C:\Windows\CCM\` `\MsiExec.exe" /Y C:\Windows\CCM\`
`Image`	ends_with	`\msiexec.exe` corpus 21 (sigma 21)