Techniques › T1218.007 › AN0445
AN0445 Analytic 0445
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection of msiexec.exe execution where command-line arguments reference remote MSI packages, UNC paths, HTTP/HTTPS URLs, or DLLs, correlated with subsequent module loads and/or network connections to previously unseen destinations. The behavioral chain links process creation of msiexec.exe with suspicious parameters, network activity to retrieve payloads, and module loading indicative of malicious installation or DLL execution.</p>
- Detects
- T1218.007 Msiexec
- Part of
- DET0158 Detection of Msiexec Abuse for Local, Network, and DLL Execution
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=4688 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=7 | DC0016 Module Load |
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
SuspiciousCommandlinePatterns | Patterns for identifying malicious msiexec.exe usage (e.g., UNC paths, external domains, DLL execution flags) |
SuspiciousDestinationList | List of external domains or IP ranges considered suspicious for msiexec network connections |
TimeWindow | Time range in seconds/minutes for correlating msiexec.exe execution with module load and network activity |
LegitimateMSIHashes | Hash list of MSI packages considered known-good to reduce false positives |