title: Always Install Elevated Windows Installer
id: cd951fdc-4b2f-47f5-ba99-a33bf61e3770
description: This rule looks for Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege
status: experimental
author: Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community
date: 2020/10/13
modified: 2022/02/18
references:
    - https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-48-638.jpg
tags:
    - attack.privilege_escalation
    - attack.t1548.002
logsource:
    product: windows
    category: process_creation
detection:
    integrity_level:
        IntegrityLevel: 'System'
    user:
        User|contains: # covers many language settings
            - 'AUTHORI'
            - 'AUTORI'
    image_1:
        Image|contains|all:
            - '\Windows\Installer\'
            - 'msi'
        Image|endswith: 'tmp'
    image_2:
        Image|endswith: '\msiexec.exe'
    filter_installer:
        ParentImage: 'C:\Windows\System32\services.exe'
    filter_repair:
        - CommandLine|endswith: '\system32\msiexec.exe /V' # ignore "repair option"
        - ParentCommandLine|endswith: '\system32\msiexec.exe /V' # ignore "repair option"
    condition: ( (image_1 and user) or (image_2 and user and integrity_level) ) and not 1 of filter*
fields:
    - IntegrityLevel
    - User
    - Image
falsepositives:
    - System administrator Usage
level: medium
