{"id":"f7b5f842-a6af-4da5-9e95-e32478f3cd2f","title":"MsiExec Web Install","description":"Detects suspicious msiexec process starts with web addresses as parameter","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2018-02-09","modified":"2022-01-07","tags":["attack.stealth","attack.t1218.007","attack.command-and-control","attack.t1105"],"technique_ids":["T1105","T1218.007"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["False positives depend on scripts and administrative tools used in the monitored environment"],"references":["https://blog.trendmicro.com/trendlabs-security-intelligence/attack-using-windows-installer-msiexec-exe-leads-lokibot/"],"source_path":"rules/windows/process_creation/proc_creation_win_msiexec_web_install.yml","source_sha256":"66ad4761f00dc4b1065d78853e46409e22ccab154c511730d25fc1d7382da547","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_msiexec_web_install.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: MsiExec Web Install\nid: f7b5f842-a6af-4da5-9e95-e32478f3cd2f\nrelated:\n    - id: 8150732a-0c9d-4a99-82b9-9efb9b90c40c\n      type: similar\nstatus: test\ndescription: Detects suspicious msiexec process starts with web addresses as parameter\nreferences:\n    - https://blog.trendmicro.com/trendlabs-security-intelligence/attack-using-windows-installer-msiexec-exe-leads-lokibot/\nauthor: Florian Roth (Nextron Systems)\ndate: 2018-02-09\nmodified: 2022-01-07\ntags:\n    - attack.stealth\n    - attack.t1218.007\n    - attack.command-and-control\n    - attack.t1105\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|contains|all:\n            - ' msiexec'\n            - '://'\n    condition: selection\nfalsepositives:\n    - False positives depend on scripts and administrative tools used in the monitored environment\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1105","id":"T1105","name":"Ingress Tool Transfer","page":"techniques/enterprise/T1105/"},{"key":"enterprise/T1218.007","id":"T1218.007","name":"Msiexec","page":"techniques/enterprise/T1218.007/"}],"data_path":"data/detection-rules/f7b5f842-a6af-4da5-9e95-e32478f3cd2f.json","kind":"sigma"}