Compared to the EXE file format, the MSI format is limited. They are nothing but an installer package, so if you feel the need to run code through MSI, well, you’re out of luck.

Microsoft has released Sysmon 15, converting it into a protected process and adding the new ‘FileExecutableDetected’ option to log when executable files are created.