Identifier / Programs / Windows
msiexec.exe
Provides the means to install, modify, and perform operations on Windows Installer from the command line. Windows commands reference
LOLBAS Execute 21 Sigma rules name it 2 ATT&CK techniques 5 documented commands 12 known copies with hashes
How msiexec.exe is abused
Execute T1218.007 System Binary Proxy Execution: Msiexec
/quietSpecifies quiet mode, which means there's no user interaction required. Windows commands reference/iSpecifies normal installation. Windows commands referenceExecute T1218.007 System Binary Proxy Execution: Msiexec
-q/iSpecifies normal installation. Windows commands referenceExecute T1218.007 System Binary Proxy Execution: Msiexec
-yExecute T1218.007 System Binary Proxy Execution: Msiexec
-zExecute T1218.007 System Binary Proxy Execution: Msiexec
/iSpecifies normal installation. Windows commands reference/qbSpecifies there's a basic UI during the installation process. Windows commands referenceEach abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for msiexec.exe.
5 documented commands
Execute T1218.007 System Binary Proxy Execution: Msiexec User privileges
Installs the target .MSI file silently.
msiexec /quiet /i {PATH:.msi}Trips no Sigma process-creation rule.
Execute T1218.007 System Binary Proxy Execution: Msiexec User privileges
Installs the target remote & renamed .MSI file silently.
msiexec /q /i {REMOTEURL}Trips 1 Sigma rule: mediumSuspicious Msiexec Quiet Install From Remote Location by Nasreddine Bencherchali (Nextron Systems)
Execute T1218.007 System Binary Proxy Execution: Msiexec User privileges
Calls DllRegisterServer to register the target DLL.
msiexec /y {PATH_ABSOLUTE:.dll}Trips 1 Sigma rule: mediumSuspicious Msiexec Execute Arbitrary DLL by frack113
Execute T1218.007 System Binary Proxy Execution: Msiexec User privileges
Calls DllUnregisterServer to un-register the target DLL.
msiexec /z {PATH_ABSOLUTE:.dll}Trips 1 Sigma rule: mediumDllUnregisterServer Function Call Via Msiexec.EXE by frack113
Execute T1218.007 System Binary Proxy Execution: Msiexec User privileges
Installs the target .MSI file from a remote URL, the file can be signed by vendor. Additional to the file a transformation file will be used, which can contains malicious code or binaries. The /qb will skip user input.
msiexec /i {PATH_ABSOLUTE:.msi} TRANSFORMS="{REMOTEURL:.mst}" /qbTrips 1 Sigma rule: mediumSuspicious Msiexec Quiet Install From Remote Location by Nasreddine Bencherchali (Nextron Systems)
4 of the 5 commands the identifier reads trip a Sigma process-creation rule; 1 trips none. These commands and their descriptions are from LOLBAS’s entry for msiexec.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for msiexec.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real msiexec.exe?
C:\Windows\system32\C:\Windows\SysWOW64\12 known copies
5.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\msiexec.exe · signed by Microsoft Windows
3e379ecdb875bb5f714ef8c969b31a75c75ab161d402cb446b592904c46e37b45.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\msiexec.exe · signed by Microsoft Windows
5cb00963e6384b069b12ab560ea62dd22554c845fe007b8b198ea60ccf47d1c55.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\msiexec.exe · signed by Microsoft Windows
0a8797d088023a7f17bb00b22ff7c91036070cca561bff5337c472313c0cb4ad5.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\msiexec.exe · signed by Microsoft Windows
3a90ede157d40a4db7859158c826f7b4d0f19a5768f6483c9be6ee481c6e1af75.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\msiexec.exe · signed by Microsoft Windows
199b3890d28a1f5906f4014e73615a268b3c4414f1f71697bf13e0d464258d545.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\msiexec.exe · signed by Microsoft Windows
8e2aa014d7729cbfee95671717646ee480561f22e2147dae87a75c18d7369d995.0.17763.404 (WinBuild.160101.0800) · C:\Windows\SysWOW64\msiexec.exe · signed by Microsoft Windows
64f5babd1b013cb35ca489af2531203261fa0b05a70a77fbc0a3d53abfdc8cab5.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\msiexec.exe · signed by Microsoft Windows
dc52a89f2fcbd8e31f2d466bd2d35414a86bb907382251fabb88cd3969fb3ec85.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\msiexec.exe · signed by Microsoft Windows
5c188ce4e21fab002b4d669f91fa19341ab4260f83d798fdac53229d675db6ba5.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\msiexec.exe · signed by Microsoft Windows
b5d755b0b561aa8fdaff156e3715a333179b14c171efb53392d4d806d14cf9c95.0.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\msiexec.exe · not signed
d88e2d981610ea24ee22b83cc284d6c616f3674e8f1f5d3794c9fcd569e8dadd5.0.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\msiexec.exe · not signed
da4a7995c19c18493ae07f4b97cfbbef584534c8f0892e4ecd00c4d0c77b60f2From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
Everyday use
Install a program from its MSI package
msiexec /package path\to\file.msiIdentify/packageInstalls or configures a product. Windows commands referenceInstall an MSI package from a website
msiexec /package https://example.com/installer.msiIdentify/packageInstalls or configures a product. Windows commands referenceInstall an MSP patch file
msiexec /update path\to\file.mspIdentify/updateInstall patches option. Windows commands referenceNone of the 3 examples the identifier reads matches LOLBAS abuse or trips a Sigma process-creation rule.
Options
Show every option of msiexec.exe
/iSpecifies normal installation./aSpecifies administrative installation./juAdvertise the product to the current user./jmAdvertise the product to all users./xUninstalls the package./quietSpecifies quiet mode, which means there's no user interaction required./passiveSpecifies unattended mode, which means the installation only shows a progress bar./qnSpecifies there's no UI during the installation process./qn+Specifies there's no UI during the installation process, except for a final dialog box at the end./qbSpecifies there's a basic UI during the installation process./qb+Specifies there's a basic UI during the installation process, including a final dialog box at the end./qrSpecifies a reduced UI experience during the installation process./qfSpecifies a full UI experience during the installation process./norestartStops the device from restarting after the installation completes./promptrestartPrompts the user if a reboot is required./forcerestartRestarts the device after the installation completes./liTurns on logging and includes status messages in the output log file./lwTurns on logging and includes non-fatal warnings in the output log file./leTurns on logging and includes all error messages in the output log file./laTurns on logging and includes information about when an action started in the output log file./lrTurns on logging and includes action-specific records in the output log file./luTurns on logging and includes user request information in the output log file./lcTurns on logging and includes the initial UI parameters in the output log file./lmTurns on logging and includes out-of-memory or fatal exit information in the output log file./loTurns on logging and includes out-of-disk-space messages in the output log file./lpTurns on logging and includes terminal properties in the output log file./lvTurns on logging and includes verbose output in the output log file./lxTurns on logging and includes extra debugging information in the output log file./l+Turns on logging and appends the information to an existing log file./lTurns on logging and logs all information, except verbose information (/lv) or extra debugging information (/lx)./pInstalls a patch./updateInstall patches option./packageInstalls or configures a product./fpRepairs the package if a file is missing./foRepairs the package if a file is missing, or if an older version is installed./feRepairs the package if file is missing, or if an equal or older version is installed./fdRepairs the package if file is missing, or if a different version is installed./fcRepairs the package if file is missing, or if checksum does not match the calculated value./faForces all files to be reinstalled./fuRepairs all the required user-specific registry entries./fmRepairs all the required computer-specific registry entries./fsRepairs all existing shortcuts./fvRuns from source and re-caches the local package.