This rule detects a suspected social engineering flow where a Windows MSI installer originating from the Internet is downloaded and then executed via msiexec to install a known Remote Monitoring and Management (RMM) tool. It uses a three-event correlation on the same host: (1) an internet-origin MSI file creation event, with the MSI not sourced from a curated web-service list, (2) the same user launching msiexec to install that MSI within 10 minutes, and (3) within 5 minutes after the msiexec start, the MSI download path results in the creation of a known RMM executable file. The MSI origin event is retained as the alert payload. The rule aggregates host-scoped data, matches the MSI against a broad allow/deny domain list, normalizes file paths, and ensures the artifact ends with .msi. It then links the origin (download) event to the execute event and to a subsequent install-stage event (RMM binary creation). The detection is targeted at defense evasion and potential initial access or persistence via RMM tooling, aligning with MITRE ATT&CK techniques: T1105 (Ingress Tool Transfer) for the initial MSI, T1219 (Remote Access Tools) with T1219.002 (Remote Desktop Software) for the remote-control capability, and T1218.007 (Msiexec) for the system binary proxy execution. It purposefully notes that the rule does not deem the installer or RMM product inherently malicious and excludes installations covered by a companion rule that focuses on commonly abused web services. Acknowledged false positives include legitimate MSP deployment through approved software distribution pipelines. The rule is labeled as low severity with a risk score of 21 and is intended for Elastic Defend endpoint data, leveraging file and process events to establish cross-stage relationships and timing constraints between MSI download, execution, and RMM binary creation.