[Liran017]

Adds an observed msiexec command for silently installing a remote MSI with an obfuscated /package switch. The substituted characters are ᵃ (U+1D43), ᶜ (U+1D9C), and ᵍ (U+1D4D). NFKC normalization collapses /PᵃᶜkAᵍe to /package, so Windows runs the command as intended while detections matching the exact ASCII /package token do not fire.

The existing entry covers silent remote installation through /i. This update adds the /package alias and the Unicode modifier-letter obfuscation.

ThreatHunter.ai documented the command in an Azure30 ClickFix intrusion that retrieved the MSI from usaclodconfig[.]net: https://www.threathunter.ai/blog/azure30-nodejs-backdoor-trojanized-msi-clickfix

[wietze]

Hey @Liran017 , thank you for posting this! Command-line obfuscation is a particular interest of mine, and that seems to be exactly what is going on here: the actor replaced the A/C/G characters with spacing modifier characters. However, each of msiexec's command-line arguments' characters can be replaced with a spacing modifier letter equivalent. As your example also shows, the option character / can be replaced with -.

All that is to say that what you're surfacing here is a technique in itself, or a "class" of bypasses. The LOLBAS project tries to document specific functionality in executables; as such, I don't think this is the right place/way to document this finding, as relevant as it is may be to defenders.

As such, I'm closing this PR for now. If you disagree or think there is a different way in which we can make people aware of command-line obfuscation options relating to this binary, please do let me know.