value:  Duqu has used msiexec to execute malicious Windows Installer packages. Additionally a PROPERTY=VALUE pair containing a 56-bit encryption key has been used to decrypt the main payload from the installer packages. 
name: Signed Binary Proxy Execution: Msiexec