Sunturai
Back to results
MediumSigmaHQNasreddine Bencherchali (Nextron Systems)

MSI Installation From Suspicious Locations

Detects MSI package installation from suspicious locations

Detection logic

Detection requirements

Log source product
windows
Log source service
application

Known benign triggers

  • False positives may occur if you allow installation from folders such as the desktop, the public folder or remote shares. A baseline is required before production use.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice