Msiexec installing a package or DLL from a remote source

Siemphony@siemphonymediumT1218.007verified in lab

Matches process creation of msiexec.exe whose command line names a package reached over HTTP, HTTPS or FTP, a UNC path, or one of the DLL entry-point switches (`/y` DllRegisterServer, `/z` DllUnRegisterServer) — the three argument shapes AN0445 lists under its SuspiciousCommandlinePatterns knob, populated here with the URL schemes, the UNC prefix and the switch letters that LOLBAS documents for this binary. The UNC leg is written as four backslashes in YAML so Sigma sees the two literal backslashes a UNC prefix needs; two would degrade to "contains a backslash", which every local install satisfies. The rest of AN0445 is a correlation the analytic states plainly — the process creation, then a module load, then a connection to a previously-unseen destination inside TimeWindow — and Sigma has no join and no baseline of seen destinations, so only the process-creation leg is written here; the module-load and network legs are deliberately absent rather than faked with a destination list this brief does not supply. The rule is written in the Sysmon-shaped `process_creation` vocabulary (`Image`, `CommandLine`) that the brief's sigmaLogsource selects; fed from Security 4688 instead, it needs *Audit Process Creation* and the separate *Include command line in process creation events* policy, neither of which is on by default, and a pipeline that maps `Image` onto `NewProcessName`. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0158, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (FolderPath endswith "\\msiexec.exe" and ((ProcessCommandLine contains "http://" or ProcessCommandLine contains "https://" or ProcessCommandLine contains "ftp://" or ProcessCommandLine contains "\\\\") or (ProcessCommandLine contains "-y " or ProcessCommandLine contains "/y " or ProcessCommandLine contains "–y " or ProcessCommandLine contains "—y " or ProcessCommandLine contains "―y " or ProcessCommandLine contains "-z " or ProcessCommandLine contains "/z " or ProcessCommandLine contains "–z " or ProcessCommandLine contains "—z " or ProcessCommandLine contains "―z ")))

Splunk · SPL

Run this as a search.

index=* (Image="*\\msiexec.exe" AND ((CommandLine="*http://*" OR CommandLine="*https://*" OR CommandLine="*ftp://*" OR CommandLine="*\\\\*") OR (CommandLine="*-y *" OR CommandLine="*/y *" OR CommandLine="*–y *" OR CommandLine="*—y *" OR CommandLine="*―y *" OR CommandLine="*-z *" OR CommandLine="*/z *" OR CommandLine="*–z *" OR CommandLine="*—z *" OR CommandLine="*―z *")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.executable) LIKE "*\\\\msiexec.exe" AND ((TO_LOWER(process.command_line) LIKE "*http://*" OR TO_LOWER(process.command_line) LIKE "*https://*" OR TO_LOWER(process.command_line) LIKE "*ftp://*" OR TO_LOWER(process.command_line) LIKE "*\\\\\\\\*") OR (TO_LOWER(process.command_line) LIKE "*-y *" OR TO_LOWER(process.command_line) LIKE "*/y *" OR TO_LOWER(process.command_line) LIKE "*–y *" OR TO_LOWER(process.command_line) LIKE "*—y *" OR TO_LOWER(process.command_line) LIKE "*―y *" OR TO_LOWER(process.command_line) LIKE "*-z *" OR TO_LOWER(process.command_line) LIKE "*/z *" OR TO_LOWER(process.command_line) LIKE "*–z *" OR TO_LOWER(process.command_line) LIKE "*—z *" OR TO_LOWER(process.command_line) LIKE "*―z *")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\msiexec\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)((http://|https://|ftp://|\\\\)|(-y |/y |–y |—y |―y |-z |/z |–z |—z |―z ))</field>    <description>Msiexec installing a package or DLL from a remote source</description>    <mitre>      <id>T1218.007</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: signed_binary_proxy
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: b500ff4d-98fe-4525-b1d7-61b58d6fad07

ATT&CKT1218.007

T1218.007Msiexec

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonsigned binary proxy

signed binary proxyAI draft — unreviewed

01 · What this rule detects

The rule watches for msiexec.exe being created with a command line that names a package somewhere other than the local disk, or that asks the installer to call a DLL entry point. It is one leg of a longer chain: AN0445 describes process creation correlated with a module load and a connection to a previously unseen destination. Sigma has no join and no baseline of seen destinations, so only the process-creation leg exists here. The rule is narrower than the analytic it came from, and knowing which two thirds are missing is the point.

02 · Telemetry you need

process_creation on Windows, taken verbatim from the brief. In practice that is Sysmon EventID 1, which gives you Image and CommandLine with no extra configuration. If you feed it from Security 4688 instead, two policies must be on that are off in a default install and in the MS and CIS baselines: Audit Process Creation, and the separate Include command line in process creation events. Without the second one CommandLine is empty and every leg of this rule silently fails to match. You also need a field mapping, because the rule is written in the Sysmon-shaped vocabulary — 4688 calls the binary NewProcessName.

03 · How the logic works

Three selections, combined as selection_msiexec and (selection_remote_source or selection_dll_switch). selection_msiexec gates on Image|endswith: '\msiexec.exe'. The process that gets created really is msiexec, so this is a safe anchor — unlike a network event, where the socket often belongs to a service rather than the tool. selection_remote_source is a CommandLine|contains list of http://, https://, ftp:// and a UNC prefix. Note the UNC value is '\\\\' — four backslashes in YAML, which Sigma reads as the two literal backslashes a UNC path starts with. Written with two, it would collapse to "contains a backslash", true of every local install, and the rule would look tight while matching everything. Be aware ftp:// is defensive breadth, not a supported msiexec source scheme. selection_dll_switch matches /y and /z with a trailing space under the windash modifier, covering the -y/–y variants. These are the DllRegisterServer and DllUnRegisterServer entry points. This is the genuinely anomalous half of the rule; the trailing space is also its weak point, since msiexec /yC:\payload.dll runs and does not match.

04 · Common false positives

Overwhelmingly on the UNC leg. Configuration Manager, Intune Win32 wrappers and Group Policy Software Installation all point msiexec at a distribution point or SYSVOL, so in a managed estate this fires on essentially every install, repair and installer-resiliency re-run, continuously, under SYSTEM. The HTTPS leg has a second noise shape the false positives understate: any install whose command line carries a URL property value — msiexec /i agent.msi SERVERURL=https://tenant.example.com — matches even though the package is local. MDM, monitoring, VPN and AV clients all deploy this way. The /y and /z legs are quiet by comparison.

05 · Detection maturity

tier_1: Lowest tier. This rule is machine-derived from DET0158 and has never been run against a log line, so it has no measured hit rate, no false-positive baseline and no evidence it fires on the technique. Treat it as a scaffold to run in audit mode against your own history before it earns anything above the bottom rung.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE's knobs for AN0445 are SuspiciousCommandlinePatterns, SuspiciousDestinationList, LegitimateMSIHashes and TimeWindow. The URL schemes, the UNC prefix and the switch letters populating the first of those are the pipeline's own, drawn from LOLBAS, not MITRE values. Start by allowlisting your deployment infrastructure's UNC roots and its parent processes, then the URL hosts your agents use as property values. The stronger move is to split the rule: the UNC leg belongs at low on its own, and the DLL switches keep medium. Level medium as written is arguably too high against a first false positive that matches every install in the estate.

Declared by the author

Enterprise software deployment. Configuration Manager, Intune and Group Policy Software Installation all invoke msiexec against a package on a distribution point or SYSVOL share, so the UNC leg matches every scheduled application install and repair in a managed estate — by a wide margin the highest-volume match this rule produces, and the reason the level is not higher.
Vendor updaters and bootstrappers that hand msiexec an HTTPS package URL directly rather than downloading first, which run unattended under SYSTEM on a patch cadence and hit the http/https leg.
Windows Installer resiliency. When a product installed from a network location needs a repair, the installer re-runs the original source path, reproducing the UNC command line long after the deployment window closed.
Manual administration and troubleshooting, where an admin registers or unregisters an MSI-shipped DLL with msiexec /y or /z, or a vendor install guide instructs them to.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Verified in Siemphony lab

Security Datasets — Msiexec proxy execution
passed
Siemphony IR · 3 Sept 2026
4 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1218.007, evaluated against their process_creation events.

Share this rule

/u/siemphony/b500ff4d-98fe-4525-b1d7-61b58d6fad07

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Msiexec installing a package or DLL from a remote source

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it