T1218.007 Msiexec

Technique

T1218.007

Tactics

Defense Evasion

Research, 90 days

1

KEV CVEs mapped

0

SigmaHQ rules

10

Elastic, Splunk

27

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1218/007

MITRE description

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).(Citation: Microsoft msiexec) The Msiexec.exe binary may also be digitally signed by Microsoft. Adversaries may abuse msiexec.exe to launch local or network accessible MSI files. Msiexec.exe can also execute DLLs.(Citation: LOLBAS Msiexec)(Citation: TrendMicro Msiexec Feb 2018) Since it may be signed and native on Windows systems, msiexec.exe can be used to bypass application control solutions that do not account for its potential abuse. Msiexec.exe execution may also be elevated to SYSTEM privileges if the <code>AlwaysInstallElevated</code> policy is enabled.(Citation: Microsoft AlwaysInstallElevated 2018)

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-09-29 Microsoft Threat Intelligence: Phishing Abuses RMM Tools for Persistent Access

Detection coverage

SigmaHQ community rules

• Msiexec.EXE Initiated Network Connection Over HTTP (threat-hunting)
• MSI Installation From Web (core)
• PowerShell WMI Win32_Product Install MSI (core)
• DllUnregisterServer Function Call Via Msiexec.EXE (core)
• Suspicious MsiExec Embedding Parent (core)
• Suspicious Msiexec Execute Arbitrary DLL (core)
• Msiexec Quiet Installation (core)
• Suspicious Msiexec Quiet Install From Remote Location (core)
• MsiExec Web Install (core)
• Obfuscated PowerShell MSI Install via WindowsInstaller COM (core)

Elastic and Splunk rules

• RMM Software Installation from a Commonly Abused Web Service (elastic)
• RMM Software Installation from an Internet-Originated MSI (elastic)
• Suspicious ScreenConnect Client Child Process (elastic)
• Suspicious Microsoft HTML Application Child Process (elastic)
• MsiExec Service Child Process With Network Connection (elastic)
• Potential Remote Install via MsiExec (elastic)
• Unusual Network Activity from a Windows System Binary (elastic)
• Suspicious Execution from a Mounted Device (elastic)
• Potential ClickFix Command via Windows Run Dialog (elastic)
• Potential FileFix Command via Windows Explorer Address Bar (elastic)
• Execution of a Downloaded Windows Script (elastic)
• Potential Remote File Execution via MSIEXEC (elastic)
• Suspicious JetBrains TeamCity Child Process (elastic)
• Suspicious Execution from VS Code Extension (elastic)
• Persistence via a Windows Installer (elastic)
• Potential Escalation via Vulnerable MSI Repair (elastic)
• Windows Installer with Suspicious Properties (elastic)
• Suspicious Execution via MSIEXEC (elastic)
• Uninstall App Using MsiExec (splunk)
• Windows HTTP Network Communication From MSIExec (splunk)
• Windows MSI Rollback Script Deleted By Non-Msiexec Process (splunk)
• Windows MSIExec DLLRegisterServer (splunk)
• Windows MsiExec HideWindow Rundll32 Execution (splunk)
• Windows MSIExec Remote Download (splunk)
• Windows MSIExec Spawn Discovery Command (splunk)

Showing 25 of 27.

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.