| elastic |
Unusual Network Activity from a Windows System Binary |
production |
2026-10-19 |
| sigma |
DllUnregisterServer Function Call Via Msiexec.EXE |
test |
2026-10-19 |
| elastic |
MsiExec Service Child Process With Network Connection |
production |
2026-10-09 |
| elastic |
Suspicious Microsoft HTML Application Child Process |
production |
2026-10-09 |
| elastic |
Persistence via a Windows Installer |
production |
2026-10-05 |
| elastic |
Potential FileFix Command via Windows Explorer Address Bar |
production |
2026-10-05 |
| elastic |
Potential ClickFix Command via Windows Run Dialog |
production |
2026-10-05 |
| splunk |
Windows MSIExec DLLRegisterServer |
production |
2026-10-02 |
| splunk |
Windows HTTP Network Communication From MSIExec |
production |
2026-10-02 |
| splunk |
Windows MSIExec Unregister DLLRegisterServer |
production |
2026-10-02 |
| splunk |
Windows MSIExec Remote Download |
production |
2026-10-02 |
| elastic |
Potential Remote Install via MsiExec |
production |
2026-09-18 |
| elastic |
RMM Software Installation from a Commonly Abused Web Service |
production |
2026-09-18 |
| elastic |
RMM Software Installation from an Internet-Originated MSI |
production |
2026-09-18 |
| elastic |
Suspicious ScreenConnect Client Child Process |
production |
2026-09-18 |
| elastic |
Suspicious Execution from a Mounted Device |
production |
2026-09-18 |
| elastic |
Execution of a Downloaded Windows Script |
production |
2026-09-18 |
| elastic |
Potential Remote File Execution via MSIEXEC |
production |
2026-09-18 |
| elastic |
Suspicious JetBrains TeamCity Child Process |
production |
2026-09-18 |
| elastic |
Suspicious Execution from VS Code Extension |
production |
2026-09-18 |
| elastic |
Potential Escalation via Vulnerable MSI Repair |
production |
2026-09-18 |
| sigma |
Msiexec Quiet Installation |
test |
2026-07-28 |
| splunk |
Windows MSI Rollback Script Deleted By Non-Msiexec Process |
production |
2026-07-20 |
| splunk |
Uninstall App Using MsiExec |
production |
2026-05-13 |
| splunk |
Windows MsiExec HideWindow Rundll32 Execution |
production |
2026-05-13 |
| splunk |
Windows MSIExec Spawn Discovery Command |
production |
2026-05-13 |
| splunk |
Windows MSIExec Spawn WinDBG |
production |
2026-05-13 |
| sigma |
Suspicious Msiexec Execute Arbitrary DLL |
test |
2026-01-09 |
| sigma |
Suspicious Msiexec Quiet Install From Remote Location |
test |
2025-10-07 |
| sigma |
Obfuscated PowerShell MSI Install via WindowsInstaller COM |
experimental |
2025-05-27 |
| sigma |
Msiexec.EXE Initiated Network Connection Over HTTP |
test |
2024-07-16 |
| sigma |
MSI Installation From Web |
test |
2022-10-23 |
| sigma |
Suspicious MsiExec Embedding Parent |
test |
2022-07-14 |
| sigma |
PowerShell WMI Win32_Product Install MSI |
test |
2022-04-24 |
| sigma |
MsiExec Web Install |
test |
2022-01-07 |