T1218.007 — Msiexec

Tactic: Stealth · Platforms: Windows

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi). The Msiexec.exe binary may also be digitally signed by Microsoft. Adversaries…

Sub-technique of System Binary Proxy Execution (T1218).

Sigma detection rules (1)

T1218.007 System Binary Proxy Execution: Msiexec

title: "T1218.007 System Binary Proxy Execution: Msiexec"
id: cf800d54-82ea-4cfa-9b1f-0836e59c1d6a
description: 'Detection of Msiexec Abuse for Local, Network, and DLL Execution. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: SuspiciousCommandlinePatterns, SuspiciousDestinationList, TimeWindow, LegitimateMSIHashes.'
references:
  - https://attack.mitre.org/techniques/T1218/007
author: Shahrukh Khan
date: 2026-03-23
license: MIT
tags:
  - attack.stealth
  - attack.t1218.007

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_network_install:
    Image|endswith: '\msiexec.exe'
    CommandLine|contains: 'http'

  selection_dll_execution:
    Image|endswith: '\msiexec.exe'
    CommandLine|contains: ' /y '

  condition: 1 of selection_*

falsepositives:
  - Legitimate remote MSI-based software deployment tools referencing an http(s) package URL, or administrative use of msiexec /y for DLL registration/repair.

level: high

Related sub-techniques

Explore