detect-malcious-use-of-msiexec

//Find possible download and execution using MsiexecDeviceProcessEvents| where Timestamp > ago(7d)//MSIExec| where FileName =~ "msiexec.exe" and //With domain in command line(ProcessCommandLine has "http" and ProcessCommandLine has "return")//Find PowerShell running files from the temp folderDeviceProcessEvents| where Timestamp > ago(7d)//Looking for PowerShell| where FileName =~ "powershell.exe"//Looking for %temp% in the command line indicating deployment and ProcessCommandLine contains "%temp%"//Find credential theft attempts using Msiexec to run Mimikatz commandsDeviceProcessEvents| where Timestamp > ago(7d)| where InitiatingProcessFileName =~ "msiexec.exe"//Mimikatz commandsand (ProcessCommandLine contains "privilege::" or ProcessCommandLine has "sekurlsa" or ProcessCommandLine contains "token::")