Sigma rule: MSI Installation From Suspicious Locations

Rule

Title

MSI Installation From Suspicious Locations

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2022-08-31

Modified

2023-10-23

File

rules/windows/builtin/application/msiinstaller/win_msi_install_from_susp_locations.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects MSI package installation from suspicious locations

Log source

product

windows

service

application

Detection

selection:
    Provider_Name: 'MsiInstaller'
    EventID:
        - 1040
        - 1042
    Data|contains:
        # Add more suspicious paths
        - ':\Windows\TEMP\'
        - '\\\\'
        - '\Desktop\'
        - '\PerfLogs\'
        - '\Users\Public\'
        # - '\AppData\Local\Temp\'  # too many FPs
        # - '\Downloads\'  # too many FPs, typical legitimate staging directory
filter_winget:
    Data|contains: '\AppData\Local\Temp\WinGet\'
filter_updhealthtools:
    Data|contains: 'C:\Windows\TEMP\UpdHealthTools.msi'
condition: selection and not 1 of filter_*

False positives (as the rule lists them)

• False positives may occur if you allow installation from folders such as the desktop, the public folder or remote shares. A baseline is required before production use.

Tags

• attack.execution

References

• https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/application/msiinstaller/win_msi_install_from_susp_locations.yml