← Back to SOC feed Coverage →

detect-malicious-use-of-msiexec-powershell

kql MEDIUM Azure-Sentinel
DeviceProcessEvents
credential-thefthuntingmicrosoftofficialpowershell
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-20T11:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may abuse msiexec.exe to execute malicious PowerShell commands for persistence or lateral movement. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential compromise through indirect execution methods.

KQL Query

DeviceProcessEvents
| where Timestamp > ago(7d)
//Looking for PowerShell
| where FileName =~ "powershell.exe"
//Looking for %temp% in the command line indicating deployment 
and ProcessCommandLine contains "%temp%"//Find credential theft attempts using Msiexec to run Mimikatz commands

Analytic Rule Definition

id: 1189dc7d-6d2a-4aa9-ad5f-bebed51474d9
name: detect-malicious-use-of-msiexec-powershell
description: |
  This query was originally published in the threat analytics report, Msiexec abuse.
  Msiexec.exe is a Windows component that installs files with the .msi extension. These kinds of files are Windows installer packages, and are used by a wide array of legitimate software. However, malicious actors can re-purpose msiexec.exe for living-off-the-land attacks, where they use legitimate system binaries on the compromised device to perform attacks.
  The following query detects activity associated with misuse of msiexec.exe, particularly alongside mimikatz, a common credential dumper and privilege escalation tool.
  Reference - https://www.varonis.com/blog/what-is-mimikatz/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Execution
- Privilege escalation
- Credential Access
query: |
  DeviceProcessEvents
  | where Timestamp > ago(7d)
  //Looking for PowerShell
  | where FileName =~ "powershell.exe"
  //Looking for %temp% in the command line indicating deployment 
  and ProcessCommandLine contains "%temp%"//Find credential theft attempts using Msiexec to run Mimikatz commands

Required Data Sources

Sentinel TableNotes
DeviceProcessEventsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Execution/detect-malicious-use-of-msiexec-powershell.yaml