Used by Windows to execute msi files
msiexec /z "C:\folder\evil.dll"
Calls DLLRegisterServer to un-register the target DLL.
Execute dll files
C:\Windows\System32\msiexec.exe, C:\Windows\SysWOW64\msiexec.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_msiexec_web_install.yml, Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_msiexec_masquerading.yml, Elastic: https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_network_connection_from_windows_binary.toml, Splunk: https://github.com/splunk/security_content/blob/18f63553a9dc1a34122fa123deae2b2f9b9ea391/detections/endpoint/uninstall_app_using_msiexec.yml, IOC: msiexec.exe retrieving files from Internet
netbiosX (@netbiosX), Philip Tsukerman (@PhilipTsukerman)