splApache-2.0from splunk/security_content
Windows HTTP Network Communication From MSIExec
The following analytic detects MSIExec making network connections over ports 443 or 80. This behavior is identified by correlating process creation events from Endpoint Detection and Response (EDR) agents with network traffic logs. Typically, MSIExec does not perform network communication to the internet, making this activity unusual and potentially indicative of malicious behavior. If confirmed malicious, an attacker could be using MSIExec to download or communicate with external servers, potentially leading to data exfiltration, command and control (C2) communication, or further malware deployment.
Quality
59
FP risk
—
Forks
0
Views
0
Rule sourcedetections/endpoint/windows_http_network_communication_from_msiexec.yml
| tstats `security_content_summariesonly`
count
FROM datamodel=Endpoint.Processes where
`process_msiexec`
by _time Processes.action Processes.dest Processes.original_file_name
Processes.parent_process Processes.parent_process_exec
Processes.parent_process_guid Processes.parent_process_id
Processes.parent_process_name Processes.parent_process_path
Processes.process Processes.process_exec Processes.process_guid
Processes.process_hash Processes.process_id
Processes.process_integrity_level Processes.process_name
Processes.process_path Processes.user Processes.user_id
Processes.vendor_product
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| join process_id [
| tstats `security_content_summariesonly`
count
FROM datamodel=Network_Traffic.All_Traffic where
All_Traffic.dest_port IN ("80","443")
by All_Traffic.action All_Traffic.app All_Traffic.bytes
All_Traffic.bytes_in All_Traffic.bytes_out All_Traffic.dest
All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc
All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src
All_Traffic.src_ip All_Traffic.src_port All_Traffic.transport
All_Traffic.user All_Traffic.vendor_product All_Traffic.direction
All_Traffic.process_id
| `drop_dm_object_name(All_Traffic)`
]
| table _time user dest parent_process_name process_name
process_path process process_id dest_port dest_ip
| `windows_http_network_communication_from_msiexec_filter`