CreateInstallv200335

Hunt Hypothesis

This detection identifies adversaries executing specific installation processes via the CreateInstall mechanism, which often indicates early-stage persistence or software deployment activities that could mask malicious behavior. A proactive hunt is essential in Azure Sentinel to distinguish legitimate administrative installations from potential supply chain compromises or unauthorized tool usage before they escalate into more severe incidents.

YARA Rule

rule CreateInstallv200335
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the CreateInstallv200335 detection rule in an enterprise environment:

• Scenario: Scheduled Deployment of Microsoft Office via Group Policy

  • Context: The domain controller pushes a silent installation package (setup.exe) to user workstations during off-hours. The YARA rule flags the creation of the CreateInstallv200335 process as suspicious because it mimics an installer execution often seen in supply chain attacks.
  • Filter/Exclusion: Add a whitelist for the specific hash or file path of the Office deployment executable (e.g., C:\Windows\Installer\Microsoft_Office_2019_Setup.exe) and restrict the alert to only trigger if the parent process is NOT msiexec.exe running under the SYSTEM account.

• Scenario: Automated Patching via SCCM/Intune

  • Context: System Center Configuration Manager (SCCM) or Microsoft Intune executes a scheduled task to install critical security updates. The installer invokes a temporary process named CreateInstallv200335 as part of the installation chain, triggering the rule on endpoints where this specific version is not yet recognized in the baseline.
  • Filter/Exclusion: Create an exclusion based on the command line arguments containing keywords like /quiet, /norestart, or SCCM. Alternatively, exclude any instance where the parent process name is ccmexec.exe (the SCCM agent) or Microsoft.IntuneManagementExtension.exe.

• Scenario: Third-Party Antivirus Definition Updates

  • Context: Enterprise antivirus solutions like CrowdStrike Falcon or Carbon Black run a background service to update their definition databases. This process often spawns a helper installer named CreateInstallv200335 to register new signatures, which the Y