InnoSetupModulev129

Hunt Hypothesis

This hunt detects the execution of InnoSetup installer modules (version 129), which adversaries often leverage to deliver custom payloads or obfuscate initial installation stages during software deployment. A SOC team should proactively hunt for this behavior in Azure Sentinel to identify potential supply chain compromises or living-off-the-land tactics where attackers utilize legitimate installers to establish a foothold before deploying malicious components.

YARA Rule

rule InnoSetupModulev129
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 EC 89 45 C0 E8 5B 73 FF FF E8 D6 87 FF FF E8 C5 A9 FF FF E8 E0 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the InnoSetupModulev129 detection rule, including suggested filters and exclusions:

• Scenario: Deployment of Internal Line-of-Business Applications via SCCM

  • Context: The IT Operations team uses Microsoft Endpoint Configuration Manager (SCCM) to push a custom internal utility (e.g., “SecurePrintHelper”) to 500+ workstations. This utility is packaged using Inno Setup, causing the installer (setup.exe) to trigger the rule upon execution during business hours.
  • Filter/Exclusion: Create an exclusion based on the Source Process Name and User Context. Filter out alerts where ProcessName contains ccmexec.exe or smsengine.exe (SCCM agents) AND the AccountName belongs to the IT-Deployments service account group.

• Scenario: Scheduled Patching Job for Third-Party Security Tools

  • Context: A nightly scheduled task runs at 02:00 AM to update a third-party endpoint protection suite (e.g., CrowdStrike or Carbon Black). The vendor’s installer module utilizes Inno Setup under the hood, triggering the rule during the maintenance window.
  • Filter/Exclusion: Implement a time-based exclusion combined with a Hash Allowlist. Add the specific SHA-256 hash of the known good InnoSetupModulev129 binary used by the vendor to the allowlist and restrict alerts to only fire outside of the 01:00–04:00 maintenance window for this specific process.

• Scenario: Software Installation via Group Policy (GPO) Startup Scripts

  • Context: A new GPO is applied to the “Finance” OU, triggering a startup script that installs a PDF viewer or browser extension using an