Windows Privilege Escalation Attempt Via MSI Rollback — Detection Rule
Detects an attacker abusing the Windows Installer rollback mechanism to escalate privileges from a standard user to SYSTEM without triggering a UAC prompt, using a technique known as FolderContentsDeleteToFolderDelete. Windows Installer (msiexec.exe) creates rollback scripts during software installation to undo changes if an installation fails. These rollback scripts are generated and executed by the Windows Installer service, which runs as SYSTEM. The FolderContentsDeleteToFolderDelete technique abuses this trusted mechanism by crafting a malicious rollback script that instructs the SYSTEM-level Installer service to delete attacker-chosen files or directories — effectively giving a low-privileged attacker the ability to make SYSTEM-level filesystem modifications without any privilege prompt.