Unexpected child process spawned by msiexec.exe

Siemphony@siemphonymediumT1546.016unverified

Matches AN0940's Windows leg: `msiexec.exe` — the Windows Installer engine that runs every `.msi` package's custom actions — spawning a scripting host or living-off-the-land binary as a direct child, the shape a malicious postinstall or custom-action script takes once it needs to execute beyond what MSI's own actions provide. This is the only one of the brief's three platform analytics with log sources concrete enough to author against: AN0938's macOS leg and AN0939's Linux leg point at `/usr/sbin/installer` and dpkg/rpm maintainer scripts respectively, but their `sigmaLogsource` objects carry no `eventIds` and the brief gives no field-level detail for `unifiedlog` or `auditd:SYSCALL` beyond prose, so no field is asserted for those platforms here. `ParentImage` is scoped to `msiexec.exe` itself rather than a third-party wrapper like `setup.exe`, because AN0940's `InstallerParent` knob names wrappers as a separate case this rule does not attempt to enumerate. A legitimate MSI custom action calling `cscript.exe` to run a bundled VBScript looks identical here to one calling it to run a dropped payload; only the file's origin path, visible by pivoting into the Sysmon EventID 11 file-creation leg AN0940 also lists, actually separates them. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0330, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (InitiatingProcessFolderPath endswith "\\msiexec.exe" and (FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe" or FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\rundll32.exe" or FolderPath endswith "\\regsvr32.exe" or FolderPath endswith "\\certutil.exe"))

Splunk · SPL

Run this as a search.

index=* (ParentImage="*\\msiexec.exe" AND (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\cmd.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\certutil.exe"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.parent.executable) LIKE "*\\\\msiexec.exe" AND (TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cmd.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mshta.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rundll32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\regsvr32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\certutil.exe"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)\\msiexec\.exe$</field>    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$|\\cmd\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\mshta\.exe$|\\rundll32\.exe$|\\regsvr32\.exe$|\\certutil\.exe$)</field>    <description>Unexpected child process spawned by msiexec.exe</description>    <mitre>      <id>T1546.016</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: registry_persistence
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: c19abfd3-effb-42f6-b028-64252185b30f

ATT&CKT1546.016

T1546.016Installer Packages

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonregistry persistence

registry persistenceAI draft — unreviewed

01 · What this rule detects

AN0940 describes msiexec.exe running installer custom actions that result in anomalous process creation — a malicious .msi postinstall or custom action executing beyond what MSI's own actions provide. This rule matches that shape directly: msiexec.exe as the immediate parent of a scripting host or living-off-the-land binary. It is the only one of the brief's three platform analytics authored here — AN0938 (macOS) and AN0939 (Linux) point at /usr/sbin/installer and dpkg/rpm maintainer scripts, but their sigmaLogsource objects carry no eventIds and the brief gives no field-level detail beyond prose, so nothing was asserted for those platforms.

02 · Telemetry you need

Sysmon EventID 1, process_creation/windows, needing no special audit policy beyond a standard Sysmon deployment. ParentImage and Image are real fields for this logsource. AN0940 also names Sysmon EventID 11 (file_event) to catch the payload landing in %TEMP% or similar, and an ExecutionTimeWindow knob to correlate the two — neither is implementable in a single Sigma rule, so this selector covers only the parent-child process relationship.

03 · How the logic works

Two selections, ANDed: selection_parent requires ParentImage|endswith: '\msiexec.exe'; selection_child requires Image to end with one of nine binaries — powershell.exe, pwsh.exe, cmd.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe. ParentImage is scoped to msiexec.exe itself, not a third-party wrapper — AN0940's own InstallerParent knob names wrappers like setup.exe as a separate case, and this rule doesn't attempt to enumerate them. That scoping choice is disclosed in the description, but the reviewer flagged it as a real coverage gap rather than just a stylistic one: a commercial installer (InstallShield, WiX bootstrap stub) that wraps msiexec.exe and spawns the script host as msiexec's child still matches, but one where the wrapper spawns the script host as its own child — with msiexec a sibling or grandparent rather than direct parent — evades the rule entirely, since ParentImage then reads as the wrapper's name.

04 · Common false positives

Every false positive here is a legitimate installer doing exactly what installers do. FP1 is explicit that "a common pattern in enterprise packaging (InstallShield, WiX, Advanced Installer)" calling cscript.exe or PowerShell for a bundled script "is the dominant source of matches on any host that runs software deployment regularly." FP2 covers SCCM/Intune/RMM tooling wrapping its own package install in msiexec.exe and then calling rundll32.exe or regsvr32.exe to register a component. FP3 covers ordinary IT-run silent installs (Office, Java, browser plugins) shelling to cmd.exe for a precondition check. The reviewer specifically praised the level calibration here: medium, not high, exactly because the loudest false positive is stated as the highest-volume match by a wide margin — a clean example of the contract's own rule about not contradicting your first FP.

05 · Detection maturity

tier_1: . Derived from a MITRE scaffold with no query logic, never run against a log line — the wrapper-installer gap above is reasoning, not a measured miss rate.
tier_2: means running this against real endpoint data long enough to characterize how much of the match volume is enterprise packaging versus genuine anomaly, and adding the wrapper-parent selector if the gap proves material for your estate.
tier_3: ** would correlate the process match with AN0940's file-creation leg — the payload path itself — so an alert distinguishes a script calling a signed component from one calling something dropped moments earlier.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add a second parent selector for known installer wrapper binaries (setup.exe, install.exe, vendor bootstrap names) if your fleet uses wrapped MSI installs, or state plainly that wrapper-mediated installs are out of scope and need a separate rule. On the evasion side, a compiled MSI custom action DLL that calls CreateProcess internally, or an intermediate signed binary not in the nine-item list before reaching a script host, both bypass this selector with no change to the technique's mechanics — the child list is necessarily incomplete and will always trail new LOLBAS entries.

Declared by the author

Legitimate MSI custom actions that call cscript.exe or wscript.exe to run a bundled VBScript, or PowerShell to run a signed post-install configuration script — a common pattern in enterprise packaging (InstallShield, WiX, Advanced Installer) and the dominant source of matches on any host that runs software deployment regularly.
Software deployment tooling (SCCM, Intune, third-party RMM) that wraps its own package installation in msiexec.exe and then calls rundll32.exe or regsvr32.exe to register a component as part of the same install transaction.
IT-run silent installs of common enterprise applications (Office, Java, browser plugins) whose installers shell out to cmd.exe to set an environment variable or check a precondition before continuing.

Noise checkfires on 1 of 30

Fires on 1 of 30 ordinary behaviours the baseline holds for this log type. Each is something a managed estate does on purpose, so each is a false positive an analyst would have to close.

pc-regsvr32-install
An installer registering a COM component. regsvr32 is flagged constantly and is also how software installs itself.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
0 true · 1 false · 100.0% noise

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1546.016, evaluated against their process_creation events.

Share this rule

/u/siemphony/c19abfd3-effb-42f6-b028-64252185b30f

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Unexpected child process spawned by msiexec.exe

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it