DllUnregisterServer Function Call Via Msiexec.EXE (84f52741-8834-4a8c-a413-2eb2269aa6c8)

Detects MsiExec loading a DLL and calling its DllUnregisterServer function

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Msiexec - T1218.007 (365be77f-fc0e-42ee-bac8-4faf806d9336)	Attack Pattern	DllUnregisterServer Function Call Via Msiexec.EXE (84f52741-8834-4a8c-a413-2eb2269aa6c8)	Sigma-Rules	1
Msiexec - T1218.007 (365be77f-fc0e-42ee-bac8-4faf806d9336)	Attack Pattern	System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4)	Attack Pattern	2