MSI Installation From Web

Rule Info

Name
MSI Installation From Web
Author
Stamatis Chatzimangou
Description
Detects installation of a remote msi file from web.
Reference
https://twitter.com/_st0pp3r_/status/1583922009842802689
Date
2022-10-23 00:00:00
Modified
None
Id
5594e67a-7f92-4a04-b65d-1a42fd824a60
Tags
attack.defense-evasion attack.t1218 attack.t1218.007
Type
Community Rule
Link to Public Repo
https://github.com/SigmaHQ/sigma/search?q=5594e67a-7f92-4a04-b65d-1a42fd824a60

Rule History

Author
Title
Date
Commit
frack113
Merge PR #5451 from @frack113 - chore: cleanup metadata
2025-06-04
74fc1c74e
Nasreddine Bencherchali
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12
598d29f81
Qasim Qlf
Merge PR #4718 from @qasimqlf - Update ATT&CK Mapping For Some Rules
2024-02-26
1fb3ce596
frack113
Merge PR #4479 From @frack113 - Upgrade Rules Status
2023-10-17
020fc8061
Nasreddine Bencherchali
chore: rename folders
2023-04-14
6949ebf24
frack113
Order yaml field
2022-10-25
8b749fb12
schatzimangou
Msiexec update in sigma rules
2022-10-24
612f66e8a
THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022