diff --git a/rules/windows/powershell/powershell_script/posh_ps_win32_product_install_msi.yml b/rules/windows/powershell/powershell_script/posh_ps_win32_product_install_msi.yml index 36386c975..1b0fee330 100644 --- a/rules/windows/powershell/powershell_script/posh_ps_win32_product_install_msi.yml +++ b/rules/windows/powershell/powershell_script/posh_ps_win32_product_install_msi.yml @@ -1,7 +1,7 @@ -title: WMI Win32_Product Install MSI +title: PowerShell WMI Win32_Product Install MSI id: 91109523-17f0-4248-a800-f81d9e7c081d status: experimental -description: Executes an MSI using the WMI Win32_Product class +description: Detects the execution of an MSI file using PowerShell and the WMI Win32_Product class author: frack113 date: 2022/04/24 references: diff --git a/rules/windows/process_creation/proc_creation_win_msiexec_dll.yml b/rules/windows/process_creation/proc_creation_win_msiexec_dll.yml index 6f7d17bc5..c40b54851 100644 --- a/rules/windows/process_creation/proc_creation_win_msiexec_dll.yml +++ b/rules/windows/process_creation/proc_creation_win_msiexec_dll.yml @@ -1,7 +1,7 @@ title: Suspicious Msiexec Load DLL id: 84f52741-8834-4a8c-a413-2eb2269aa6c8 status: experimental -description: Loads a DLL into msiexec.exe and calls its DllUnregisterServer function. +description: Detects MsiExec loading a DLL and calling its DllUnregisterServer function references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec @@ -11,12 +11,12 @@ logsource: product: windows category: process_creation detection: - selection: + selection: Image|endswith: '\msiexec.exe' CommandLine|contains|all: - - ' /z ' + - ' /z ' - '.dll' - condition: selection + condition: selection falsepositives: - Unknown level: medium