Skip to content

Hide Navigation Hide TOC

PowerShell WMI Win32_Product Install MSI (91109523-17f0-4248-a800-f81d9e7c081d)

Detects the execution of an MSI file using PowerShell and the WMI Win32_Product class

Cluster A Galaxy A Cluster B Galaxy B Level
Msiexec - T1218.007 (365be77f-fc0e-42ee-bac8-4faf806d9336) Attack Pattern PowerShell WMI Win32_Product Install MSI (91109523-17f0-4248-a800-f81d9e7c081d) Sigma-Rules 1
Msiexec - T1218.007 (365be77f-fc0e-42ee-bac8-4faf806d9336) Attack Pattern System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4) Attack Pattern 2