MSIEXEC

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi). Msiexec.exe is digitally signed by Microsoft.

Adversaries may abuse msiexec.exe to launch local or network accessible MSI files. Msiexec.exe can also execute DLLs. Since it is signed and native on Windows systems, msiexec.exe can be used to bypass application control solutions that do not account for its potential abuse.

Example

In the following Demo a simple MSI payload (DLL) was created and used MSIexec for execution will see the flow of execution by using Process Explorer. MSIexec is capable of running dll payloads for the DLLRegisterServer parameter available in the utility[ /z & /y].

DEMO-MSIEXEC:

References:

https://lolbas-project.github.io/lolbas/Binaries/Msiexec/