LOLBin Msiexec

This query detects the use of Msiexec.exe.

CQL · Falcon Next-Gen SIEMCopy query

in(#event_simpleName, values=["ProcessRollup2","ProcessBlocked"])
| event_platform=Win and ImageFileName=/msiexec.exe/i and CommandLine=/http/i

Msiexec.exe – A Windows Installer utility that executes MSI packages or DLLs (including remote or transformed payloads), frequently misused by attackers for stealthy code execution and application control bypass.

LOLBAS - Msiexec.exe

LOLBin_Msiexec.yml

T1218.007

ByteRay GmbH

Hunting

Endpoint

Insight

2025-08-06

2025-08-26

LOLBin Msiexec

Get this query running in your SIEM, with someone on call.