CreateInstallStubvxx

Hunt Hypothesis

This rule detects the creation of an installation stub, a common precursor in supply chain attacks where adversaries embed malicious payloads within legitimate software installers to facilitate persistence or initial access. Proactively hunting for this behavior in Azure Sentinel allows the SOC to identify potential tampering or unauthorized deployment activities before the stub executes, thereby reducing the risk of compromised software entering the environment.

YARA Rule

rule CreateInstallStubvxx
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC 20 02 00 00 53 56 57 6A 00 FF 15 18 61 40 00 68 00 70 40 00 89 45 08 FF 15 14 61 40 00 85 C0 74 27 6A 00 A1 00 20 40 00 50 FF 15 3C 61 40 00 8B F0 6A 06 56 FF 15 38 61 40 00 6A 03 56 FF 15 38 61 40 00 E9 36 03 00 00 68 02 7F 00 00 33 F6 56 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Windows Installer Service Execution (msiexec.exe)

  • Scenario: The Windows Installer service (msiexec.exe) is frequently invoked by Group Policy Objects (GPOs), software distribution platforms (e.g., SCCM, Intune), or user-initiated installations to deploy or update applications. This process often creates temporary stubs or cache files in %TEMP% or C:\Windows\Installer that may match the “install stub” pattern.
  • Filter/Exclusion: Exclude events where the parent process is msiexec.exe and the file path contains \Windows\Installer\ or %TEMP%. Alternatively, exclude if the command line contains /i (install) or /a (admin) flags.

• Enterprise Software Deployment Agents (SCCM/Intune/BigFix)

  • Scenario: Configuration Management agents such as System Center Configuration Manager (SCCM), Microsoft Intune, or BigFix regularly execute deployment scripts or installers for patch management and software distribution. These agents often create temporary executable stubs or bootstrap files in specific administrative folders like C:\ProgramData\Microsoft\CCM\ or C:\Program Files\BigFix\.
  • Filter/Exclusion: Exclude file creation events originating from known deployment agent directories (e.g., C:\ProgramData\Microsoft\CCM\, C:\Program Files\BigFix\, C:\Program Files (x86)\Microsoft Intune\).

• Java Runtime Environment (JRE/JDK) Temporary Files

  • Scenario: Java applications, particularly those using the Java Web Start technology or applets, may create temporary installation stubs or cache files in the user’s %USERPROFILE%\.java\ directory or %TEMP%\ folder. This is common in legacy enterprise applications that rely on Java for business