The Rise of Malicious MSIX File

SANS Asia Pacific DFIR Summit 2023
The Rise of Malicious MSIX File
Speakers: Rintaro Koike and Shogo Hayashi

Since February 2023, we have observed an attack campaign using MSIX files. MSIX file is the successor format to MSI file, but many people are unaware of its existence and, needless to say, do not know of any abuse cases. This session will first introduce basic information on MSIX file, such as the file format, basic behavior, and the creation method, followed …

asia asia pacific attack campaign dfir february file files malicious msi msix pacific people sans speakers summit