InnoSetupModule

Hunt Hypothesis

This rule identifies the presence of Inno Setup modules, which are commonly embedded in installers to facilitate the execution of arbitrary code or file operations during the installation process. Proactively hunting for these modules allows the SOC team to detect potential supply chain compromises or unauthorized installer modifications that could lead to persistent access or privilege escalation within the environment.

YARA Rule

rule InnoSetupModule
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 49 6E 6E 6F 53 65 74 75 70 4C 64 72 57 69 6E 64 6F 77 00 00 53 54 41 54 49 43 }
	$a1 = { 55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 ?? 89 45 ?? E8 [2] FF FF E8 [2] FF FF E8 [2] FF FF E8 [2] FF FF E8 [2] FF FF }

condition:
		$a0 at pe.entry_point or $a1
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Automated deployment of internal line-of-business applications using Inno Setup-based installers (e.g., CompanyPortalSetup.exe, ERPClientInstaller.exe) pushed via SCCM or PDQ Deploy to endpoints.
  • Filter/Exclusion: Exclude processes where the parent process is a known deployment agent (e.g., CCMEXEC.EXE, PDQAGENT.EXE) or where the executable path resides in standard application directories like C:\Program Files\ or C:\Program Files (x86)\ and the filename matches known internal installer patterns (e.g., *Setup*.exe, *Install*.exe).
• Scenario: IT administrators manually installing or updating legacy software that uses Inno Setup (e.g., AdobeReader_x64_MUI.exe, Java8u391-2x64.msi wrapper scripts, or custom internal tools like BackupAgentInstaller.exe) from a network share or USB drive.
  • Filter/Exclusion: Exclude events where the user account is a member of the Domain Admins or IT Support security group, or where the source path indicates a network share (e.g., \\fileserver\apps\) or local admin execution context (explorer.exe or cmd.exe launched by an admin).
• Scenario: Scheduled maintenance jobs that reinstall or update monitoring agents or security tools built with Inno Setup (e.g., CrowdStrikeFalconInstaller.exe, ZscalerClientInstaller.exe, or internal LogCollectorSetup.exe) triggered by Task Scheduler.
  • Filter/Exclusion: Exclude processes where the parent process is SCHTASKS.EXE or TASKENG.EXE (Task Scheduler service) and the executable name matches known agent installer patterns (e.g., *Installer*.exe, `*Setup