Msiexec.EXE Initiated Network Connection Over HTTP
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects a network connection initiated by an "Msiexec.exe" process over port 80 or 443. Adversaries might abuse "msiexec.exe" to install and execute remotely hosted packages. Use this rule to hunt for potentially anomalous or suspicious communications.
Severity
Attention
Rule Requirement
Criteria
Action1: actionname = "sa_network_connection" AND IS_INITIATED = "true" AND PROCESSNAME endswith "\msiexec.exe" AND DEST_PORT = "80,443" select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.PROCESSNAME,Action1.DESTINATIONHOST,Action1.DESTINATION_IPV6,Action1.DEST_IP,Action1.SOURCEHOST,Action1.SOURCE_IP,Action1.SOURCE_IPV6
Detection
Execution Mode
realtime
Log Sources
Windows
Author
frack113
