Msiexec Execution with Caret Obfuscation

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the execution of msiexec with caret (^) obfuscation in process creation events. Adversaries may use caret obfuscation to evade detection by security tools that do not parse command-line arguments correctly. It has been observed being used in various attacks to potentially bypass security measures or to obfuscate the true nature of the command being executed.

2025-05-26 00:00:00

None

3e4d81a5-3fa7-49cf-93bc-1408b8ae6d5d

attack.defense-evasion attack.t1027.010 attack.t1218.007

Nextron Sigma feed only (private)