InnoSetupModulev109a

Hunt Hypothesis

This detection identifies the execution of Inno Setup installer modules (version 109a), which adversaries frequently leverage to deliver legitimate-looking payloads that may conceal malicious components or facilitate initial access. Proactive hunting for this behavior in Azure Sentinel is essential to distinguish between routine software deployments and potential supply chain attacks where attackers abuse trusted installers to establish a foothold within the environment.

YARA Rule

rule InnoSetupModulev109a
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 A7 7F FF FF E8 FA 92 FF FF E8 F1 B3 FF FF 33 C0 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the InnoSetupModulev109a detection rule, including recommended filters and exclusions:

• Scenario: Automated Deployment of Internal Line-of-Business (LOB) Applications via SCCM

  • Context: The IT Operations team uses Microsoft Endpoint Configuration Manager (SCCM/MECM) to push custom internal tools (e.g., “HelpDesk Portal” or “Inventory Scanner”) to endpoints. These applications are packaged using Inno Setup and distributed during the nightly maintenance window.
  • Filter/Exclusion: Create a whitelist exclusion for the SCCM client service (ccmexec.exe) acting as the parent process, specifically when launching executables with filenames matching *.exe located in the C:\Program Files\InternalApps\ directory. Additionally, add an exception for the specific Inno Setup version hash if it is consistent across deployments.

• Scenario: Scheduled Patching of Third-Party Utilities (e.g., Adobe Acrobat or Zoom)

  • Context: The enterprise utilizes a scheduled task running daily at 02:00 AM to update third-party productivity suites like Adobe Acrobat Pro or Zoom Workplace. These vendors often use Inno Setup for their installer modules, triggering the rule when the msiexec or direct executable launches the setup engine.
  • Filter/Exclusion: Exclude detection events where the parent process is Task Scheduler (taskschd.exe) and the file path contains known vendor directories (e.g., C:\Program Files\Adobe, C:\Program Files\Zoom). Alternatively, filter by the specific SHA-256 hash of the trusted Inno Setup module version used by these vendors.

• Scenario: Onboarding Scripts Executing via Group Policy Preferences

  • Context: During new employee onboarding, a Group Policy Object (GPO