MSI Transform Weaponization

An adversary can induce a user to run an MSI package with an attacker-controlled MST transform. Windows Installer applies transforms during installation and can add or replace MSI database table data; a transform that adds or changes a custom action and its install-sequence entry can cause the installer to launch a program, invoke a DLL function, or run script. This requires a transform applicable to the target package and execution of the installer; the transform itself is not executable.