From c0f39c2ef0438f38a0db345037558fe84788ddae Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 26 Jun 2025 20:15:25 +0000 Subject: [PATCH] Sigma Rule Update (2025-06-26 20:15:18) (#83) Co-authored-by: YamatoSecurity --- config/security_rules.json | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/config/security_rules.json b/config/security_rules.json index 05883bc7..33bc08cd 100644 --- a/config/security_rules.json +++ b/config/security_rules.json @@ -15002,6 +15002,23 @@ ], "title": "Suspicious Curl.EXE Download" }, + { + "category": "process_creation", + "channel": [ + "sec" + ], + "description": "Detects the execution of PowerShell commands that attempt to install MSI packages via the\nWindows Installer COM object (`WindowsInstaller.Installer`) hosted remotely.\nThis could be indication of malicious software deployment or lateral movement attempts using Windows Installer functionality.\nAnd the usage of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection.\n", + "event_ids": [ + "4688" + ], + "id": "67cbe37e-314f-cce4-2882-0cb45993a3c5", + "level": "medium", + "service": "", + "subcategory_guids": [ + "0CCE922B-69AE-11D9-BED3-505054503030" + ], + "title": "PowerShell MSI Install via WindowsInstaller COM From Remote Location" + }, { "category": "process_creation", "channel": [