{"id":"cd951fdc-4b2f-47f5-ba99-a33bf61e3770","title":"Always Install Elevated Windows Installer","description":"Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege","author":"Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community","status":"test","level":"medium","date":"2020-10-13","modified":"2024-12-01","tags":["attack.privilege-escalation","attack.t1548.002"],"technique_ids":["T1548.002"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["System administrator usage","Anti virus products","WindowsApps located in \"C:\\Program Files\\WindowsApps\\\""],"references":["https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-48-638.jpg"],"source_path":"rules/windows/process_creation/proc_creation_win_susp_always_install_elevated_windows_installer.yml","source_sha256":"0de11202d557e15231cfc262eb305587764e13dca774f1c2a619584ea8b35d5b","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_always_install_elevated_windows_installer.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Always Install Elevated Windows Installer\nid: cd951fdc-4b2f-47f5-ba99-a33bf61e3770\nstatus: test\ndescription: Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege\nreferences:\n    - https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-48-638.jpg\nauthor: Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community\ndate: 2020-10-13\nmodified: 2024-12-01\ntags:\n    - attack.privilege-escalation\n    - attack.t1548.002\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_user:\n        User|contains: # covers many language settings\n            - 'AUTHORI'\n            - 'AUTORI'\n    selection_image_1:\n        Image|contains|all:\n            - '\\Windows\\Installer\\'\n            - 'msi'\n        Image|endswith: 'tmp'\n    selection_image_2:\n        Image|endswith: '\\msiexec.exe'\n        IntegrityLevel:\n            - 'System'\n            - 'S-1-16-16384'\n    filter_installer:\n        ParentImage: 'C:\\Windows\\System32\\services.exe'\n    filter_repair:\n        - CommandLine|endswith: '\\system32\\msiexec.exe /V' # ignore \"repair option\"\n        - ParentCommandLine|endswith: '\\system32\\msiexec.exe /V' # ignore \"repair option\"\n    filter_sophos:\n        ParentImage|startswith: 'C:\\ProgramData\\Sophos\\'\n    filter_avira:\n        ParentImage|startswith: 'C:\\ProgramData\\Avira\\'\n    filter_avast:\n        ParentImage|startswith:\n            - 'C:\\Program Files\\Avast Software\\'\n            - 'C:\\Program Files (x86)\\Avast Software\\'\n    filter_google_update:\n        ParentImage|startswith:\n            - 'C:\\Program Files\\Google\\Update\\'\n            - 'C:\\Program Files (x86)\\Google\\Update\\'\n    condition: 1 of selection_image_* and selection_user and not 1 of filter_*\nfalsepositives:\n    - System administrator usage\n    - Anti virus products\n    - WindowsApps located in \"C:\\Program Files\\WindowsApps\\\"\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1548.002","id":"T1548.002","name":"Bypass User Account Control","page":"techniques/enterprise/T1548.002/"}],"data_path":"data/detection-rules/cd951fdc-4b2f-47f5-ba99-a33bf61e3770.json","kind":"sigma"}