Detection rules › Sigma

Always Install Elevated Windows Installer

Severity
medium
Author
Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community
Source
upstream

Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege

MITRE ATT&CK coverage

TacticTechniques
Privilege EscalationT1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control
Defense EvasionT1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: 1 of selection_image_1

Image|endswith: tmp
Image|contains: '\Windows\Installer\'
Image|contains: msi

Stage 2: 1 of selection_image_2

IntegrityLevel: [S-1-16-16384, System]
Image|endswith: '\msiexec.exe'

Stage 3: selection_user

or:
User|contains: AUTHORI
User|contains: AUTORI

Stage 4: not 1 of filter_*

or:
CommandLine|endswith: '\system32\msiexec.exe /V'
ParentCommandLine|endswith: '\system32\msiexec.exe /V'
ParentImage: 'C:\Windows\System32\services.exe'
ParentImage|startswith: 'C:\Program Files (x86)\Avast Software\'
ParentImage|startswith: 'C:\Program Files (x86)\Google\Update\'
ParentImage|startswith: 'C:\Program Files\Avast Software\'
ParentImage|startswith: 'C:\Program Files\Google\Update\'
ParentImage|startswith: 'C:\ProgramData\Avira\'
ParentImage|startswith: 'C:\ProgramData\Sophos\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLineends_with
  • \system32\msiexec.exe /V
Imageends_with
  • \msiexec.exe corpus 21 (sigma 21)
  • tmp
Imagematch
  • \Windows\Installer\
  • msi
IntegrityLeveleq
  • S-1-16-16384 corpus 21 (sigma 21)
  • System corpus 21 (sigma 21)
ParentCommandLineends_with
  • \system32\msiexec.exe /V
ParentImageeq
  • C:\Windows\System32\services.exe corpus 2 (sigma 2)
ParentImagestarts_with
  • C:\Program Files (x86)\Avast Software\
  • C:\Program Files (x86)\Google\Update\
  • C:\Program Files\Avast Software\
  • C:\Program Files\Google\Update\
  • C:\ProgramData\Avira\
  • C:\ProgramData\Sophos\
Usermatch
  • AUTHORI corpus 16 (sigma 16)
  • AUTORI corpus 16 (sigma 16)