Msiexec.exe is the command line utility for the Windows Installer. It runs installation packages (.msi) and may be digitally signed by Microsoft. MITRE ATT&CK tracks its abuse as T1218.007, Msiexec, in the Stealth tactic, on Windows.
How attackers use it
According to MITRE, adversaries may use msiexec.exe to launch local or network accessible MSI files, and it can also execute DLLs. Because it is signed and native, it can bypass application control solutions that do not consider its abuse.
There is an escalation angle. Msiexec.exe execution may be elevated to SYSTEM privileges if the AlwaysInstallElevated policy is enabled. That policy tells Windows Installer to run packages with elevated rights, so any user who can run an installer package gets those rights.
How to detect it
The MITRE strategy looks for msiexec.exe with command line arguments that reference remote MSI packages, UNC paths, HTTP or HTTPS URLs, or DLLs. It correlates that with module loads and with network connections to destinations you have not seen before. The chain is: process creation with suspicious parameters, then network retrieval of a payload, then a module load that suggests an installation or DLL execution.
You will see msiexec all day in normal software deployment, so tuning matters. Start with these questions:
- Is the package path a URL or a UNC path rather than a local path from your software distribution system?
- Is the user someone who normally installs software?
- Did the process make a network connection to an address that is new to your environment?
Sysmon event IDs 1, 3 and 7 cover process creation, network connections and module loads.
How to reduce the risk
- Consider disabling the AlwaysInstallElevated policy so that Windows Installer packages do not run with elevated rights.
- Restrict execution of Msiexec.exe to the privileged accounts or groups that need it.
Check your own environment
The AlwaysInstallElevated policy lives in two places, one per machine and one per user. Both need to be set for it to apply. These read-only commands (cmd.exe) show whether either is set:
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
If the value does not exist, the query returns an error, which is the good result. A value of 0x1 means the policy is on, and you should find out why.
Also check how software installs reach your fleet. If everything arrives through a management tool, then a user running msiexec against a web address is rare and worth an alert.
Where to start
Two quick wins stand out. Check the AlwaysInstallElevated policy on a sample of machines and make sure it is off, since it turns an installer into an elevation path. Then check how software reaches your fleet. If a management tool does the installing, ordinary users have no reason to run msiexec against a network path, and that gives you a simple, low noise alert.
Quick check
What does AlwaysInstallElevated change?
It lets Windows Installer packages run with elevated rights, which MITRE notes can bring msiexec.exe execution up to SYSTEM.
Sources
- MITRE ATT&CK, T1218.007: https://attack.mitre.org/techniques/T1218/007
