Installer Package Execution

Overview

Installer Package Execution is a technique where adversaries leverage legitimate software installation packages to execute malicious code on a target system. This method plays a critical role in multiple stages of the attack lifecycle by enabling initial code execution, persistence, or privilege escalation while blending with normal system activity to evade detection.

Attack Objective

• Achieve code execution and potentially persistence or privilege escalation
• Supports Initial Access, Execution, Persistence, Privilege Escalation, and Defense Evasion stages
• Advances attacker control by using trusted installer mechanisms to run unauthorized code with elevated privileges or stealth

How the Technique Works

Adversaries exploit installer packages—such as MSI, MSP, or other platform-specific installers—to deliver and execute malicious payloads. These packages often run with elevated privileges and are trusted by operating systems, allowing attackers to bypass security controls. The technique involves crafting or modifying installer files to include malicious scripts or binaries that execute during installation or update processes.

Common Methods & Variations

• Use of standard installer formats like Windows Installer (MSI), Apple Installer packages, or Linux package managers
• Deployment on endpoints, servers, or cloud environments where installers are commonly used
• Leveraging living-off-the-land binaries (LOLBins) such as msiexec.exe to execute malicious installer packages
• Custom or repackaged installers embedding malicious payloads to evade signature-based detection

Indicators of Compromise (IOCs)

• Unusual or unauthorized installer package execution events in system logs
• Execution of installer processes (e.g., msiexec.exe) outside normal maintenance windows or by unexpected users
• Presence of unknown or suspicious installer files in temporary or user directories
• Network activity associated with downloading or retrieving installer packages from untrusted sources

Detection Strategies

• Monitoring process creation logs for installer execution anomalies
• Behavioral analysis to identify installer executions that deviate from baseline patterns
• Correlation of installer execution with other suspicious activities such as privilege escalations or lateral movement
• Utilizing endpoint detection and response (EDR) tools to flag installer executions initiated by non-administrative users or unusual contexts

Mitigation & Prevention

• Implement application whitelisting to restrict execution of unauthorized installer packages
• Enforce least privilege principles to limit installer execution to trusted administrators
• Maintain updated software and patch installer frameworks to reduce exploitation opportunities
• Use code signing and integrity verification for installer packages to ensure authenticity
• Deploy network controls to restrict access to untrusted sources hosting installer files

Response Considerations

• Immediately isolate affected systems to prevent further execution or spread
• Analyze installer package files and execution logs to determine scope and intent
• Identify and remediate persistence mechanisms established via installer execution
• Review and strengthen policies around software installation and update processes
• Conduct forensic analysis to assess data exposure or additional compromise

Related Techniques

• Trusted Developer Utilities Execution (use of legitimate system tools for execution)
• Signed Binary Proxy Execution (leveraging signed binaries to execute code)
• Persistence via Registry Run Keys or Startup Folder (post-installation persistence)
• Command and Control over Installer Channels (using installer updates for communication)

Mapping & References

• MITRE ATT&CK Tactic: Execution, Persistence, Privilege Escalation, Defense Evasion
• MITRE ATT&CK Technique: T1191 – Spearphishing via Service, T1218 – Signed Binary Proxy Execution
• Public advisories on abuse of installer packages for malware delivery
• Incident reports highlighting installer package exploitation in targeted attacks