Sunturai
Back to results
MediumSplunk security contentRaven Tait +1

Windows Privilege Escalation Attempt Via MSI Rollback

Detects an attacker abusing the Windows Installer rollback mechanism to escalate privileges from a standard user to SYSTEM without triggering a UAC prompt, using a technique known as…

Description

Detects an attacker abusing the Windows Installer rollback mechanism to escalate privileges from a standard user to SYSTEM without triggering a UAC prompt, using a technique known as FolderContentsDeleteToFolderDelete. Windows Installer (msiexec.exe) creates rollback scripts during software installation to undo changes if an installation fails. These rollback scripts are generated and executed by the Windows Installer service, which runs as SYSTEM. The FolderContentsDeleteToFolderDelete technique abuses this trusted mechanism by crafting a malicious rollback script that instructs the SYSTEM-level Installer service to delete attacker-chosen files or directories — effectively giving a low-privileged attacker the ability to make SYSTEM-level filesystem modifications without any privilege prompt.

Detection logic

Detection requirements

Platform
ContainersLinuxmacOSWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
crowdstrike_processrollup2sysmon_eventid_1windows_event_log_security_4688

Known benign triggers

  • Some legitimate system cleanup or maintenance scripts may use similar FolderContentsDeleteToFolderDelete commands. Review and whitelist approved tools to reduce false alerts.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice