Cortex XDR
#Scenario
Analyse how threat actors abuse the trusted system installer to pull down external payloads, and hunt on this common initial access vector.
markdown
> Make sure you're comfortable with the results in your own environment before using this more widely.
# Snippet:
## Msiexec installing from a remote URL.
An attacker delivers their payload as an MSI and asks `msiexec.exe` to fetch and install it directly from a web URL. Cleaner on disk than a downloader plus installer chain and increasingly common through 2025-2026.
- [https://attack.mitre.org/techniques/T1218/007/](https://attack.mitre.org/techniques/T1218/007/)
- [https://lolbas-project.github.io/lolbas/Binaries/Msiexec/](https://lolbas-project.github.io/lolbas/Binaries/Msiexec/)
Logic: any HTTP(S) URL on an `msiexec` command line should be reviewed, since modern software vendors push MSIs through managed deployment rather than ad-hoc URLs.xql
// Make sure you're comfortable with the results in your own environment before using this more widely.
dataset = xdr_data
| filter event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START
| filter lowercase(action_process_image_name) = "msiexec.exe"
| filter lowercase(action_process_image_command_line) contains "http://"
or lowercase(action_process_image_command_line) contains "https://"
| fields _time, agent_hostname, actor_effective_username,
causality_actor_process_image_name, action_process_image_command_line
| limit 200