Suspicious Msiexec Quiet Install From Remote Location

Rule Info

Name
Suspicious Msiexec Quiet Install From Remote Location
Author
Nasreddine Bencherchali (Nextron Systems)
Description
Detects usage of Msiexec.exe to install packages hosted remotely quietly
Reference
https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/
Date
2022-10-28 00:00:00
Modified
2024-03-13 00:00:00
Id
8150732a-0c9d-4a99-82b9-9efb9b90c40c
Tags
attack.defense-evasion attack.t1218.007
Type
Community Rule
Link to Public Repo
https://github.com/SigmaHQ/sigma/search?q=8150732a-0c9d-4a99-82b9-9efb9b90c40c

Rule History

Author
Title
Date
Commit
Nasreddine Bencherchali
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12
598d29f81
frack113
Merge PR #4767 from @frack113 - Update additional rules to use the `windash` modifier
2024-03-15
33bed27a7
frack113
Merge PR #4479 From @frack113 - Upgrade Rules Status
2023-10-17
020fc8061
Nasreddine Bencherchali
chore: add nextron authors tag
2023-02-01
7c38a5c49
Nasreddine Bencherchali
Fix small typos
2022-10-28
ff3d576a1
Nasreddine Bencherchali
Raspberry Robin Related Rules
2022-10-28
3cb577ddf
THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022