InnoSetupModulev2018

Hunt Hypothesis

This detection identifies the execution of InnoSetup installer modules from 2018, which adversaries may leverage to deliver custom payloads or obfuscate initial attack stages within the Azure environment. Proactively hunting for this behavior allows the SOC team to validate legitimate software deployments against potential anomalies in legacy installation patterns that could indicate early-stage compromise or supply chain manipulation.

YARA Rule

rule InnoSetupModulev2018
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 73 71 FF FF E8 DA 85 FF FF E8 81 A7 FF FF E8 C8 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the InnoSetupModulev2018 detection rule, including suggested filters and exclusions:

• Scenario: Deployment of Standard Enterprise Software via SCCM/Intune

  • Context: System Center Configuration Manager (SCCM) or Microsoft Intune pushes a standard application package (e.g., Adobe Acrobat Reader or Zoom) to endpoints. These packages often utilize Inno Setup as the underlying installer engine, triggering the rule during the installation phase on multiple machines simultaneously.
  • Suggested Filter/Exclusion: Create an exclusion based on the Process Name (setup.exe) running under a known service account (e.g., NT SERVICE\CCM or SYSTEM). Additionally, filter by Parent Process being ccmexec.exe (SCCM) or IntuneManagementExtension.exe.

• Scenario: Scheduled Patching of Internal Line-of-Business Applications

  • Context: A nightly scheduled task runs a custom internal application installer built with Inno Setup to update legacy tools used by the finance department. This occurs automatically at 02:00 AM via Windows Task Scheduler, generating alerts even though no user interaction is involved.
  • Suggested Filter/Exclusion: Exclude events where the Parent Process is svchost.exe (specifically the TaskScheduler service) and the execution time falls within a defined maintenance window (e.g., 01:00–04:00). Alternatively, whitelist the specific SHA-256 hash of the known internal installer executable.

• Scenario: Admin Manual Installation via Remote Desktop Session

  • Context: A System Administrator logs into a server or workstation via Remote Desktop Services (RDS) to manually install a new utility tool using an .exe file downloaded from the corporate intr