PowerShell MSI Install via WindowsInstaller COM From Remote Location

Severity: medium
Author: Meroujan Antonyan (vx3r)
Source: upstream

Detects the execution of PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (WindowsInstaller.Installer) hosted remotely. This could be indication of malicious software deployment or lateral movement attempts using Windows Installer functionality. And the usage of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059.001` Command and Scripting Interpreter: PowerShell
Defense Evasion	`T1218` System Binary Proxy Execution
Command & Control	`T1105` Ingress Tool Transfer

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation

Stages and Predicates

Stage 1: `all of selection_img`

or:
Image|endswith: '\powershell.exe'
Image|endswith: '\powershell_ise.exe'
Image|endswith: '\pwsh.exe'
OriginalFileName: PowerShell.EXE
OriginalFileName: PowerShell_ISE.EXE
OriginalFileName: pwsh.dll

Stage 2: `all of selection_cli`

CommandLine|contains: -ComObject
CommandLine|contains: 'InstallProduct('

Stage 3: `all of selection_remote`

or:
CommandLine|contains: '\\\\'
CommandLine|contains: http

Stage 4: `not 1 of filter_main_localhost`

or:
CommandLine|contains: '://127.0.0.1'
CommandLine|contains: '://localhost'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`-ComObject` corpus 2 (sigma 2) `://127.0.0.1` `://localhost` `InstallProduct(` corpus 2 (sigma 2) `\\\\` corpus 7 (sigma 7) `http` corpus 31 (sigma 31)
`Image`	ends_with	`\powershell.exe` corpus 143 (sigma 143) `\powershell_ise.exe` corpus 27 (sigma 27) `\pwsh.exe` corpus 140 (sigma 140)
`OriginalFileName`	eq	`PowerShell.EXE` corpus 64 (sigma 60, splunk 4) `PowerShell_ISE.EXE` corpus 6 (sigma 6) `pwsh.dll` corpus 72 (sigma 68, splunk 4)

PowerShell MSI Install via WindowsInstaller COM From Remote Location

MITRE ATT&CK coverage

Event coverage

Stages and Predicates

Stage 1: all of selection_img

Stage 2: all of selection_cli

Stage 3: all of selection_remote

Stage 4: not 1 of filter_main_localhost

Indicators

Stage 1: `all of selection_img`

Stage 2: `all of selection_cli`

Stage 3: `all of selection_remote`

Stage 4: `not 1 of filter_main_localhost`