Rule: suspicious msiexec directory

rules/windows/process_creation/win_susp_msiexec_cwd.yml

@@ -0,0 +1,26 @@
+title: Suspicious MsiExec Directory
+id: e22a6eb2-f8a5-44b5-8b44-a2dbd47b1144
+status: experimental
+description: Detects suspicious msiexec process starts in an uncommon directory
+references:
+    - https://twitter.com/200_okay_/status/1194765831911215104
+tags:
+    - attack.defense_evasion
+    - attack.t1036
+author: Florian Roth
+date: 2019/11/14
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection:
+        Image: '*\msiexec.exe'
+    filter:
+        Image: 
+            - 'C:\Windows\System32\\*'
+            - 'C:\Windows\SysWOW64\\*'
+            - 'C:\Windows\WinSxS\\*' 
+    condition: selection
+falsepositives:
+    - Unknown
+level: high