InnoSetupModulev304betav306v307

Hunt Hypothesis

This rule detects the presence of specific Inno Setup installer modules (versions 3.04 beta, 3.06, and 3.07) that may be leveraged by adversaries to package and execute malicious payloads or establish persistence through custom installer scripts. Proactively hunting for these artifacts in Azure Sentinel helps identify potentially compromised endpoints or unauthorized software deployments that could serve as a foothold for further post-exploitation activities.

YARA Rule

rule InnoSetupModulev304betav306v307
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 B3 70 FF FF E8 1A 85 FF FF E8 25 A7 FF FF E8 6C }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or IT administrator performs a local test build of an application installer using the Inno Setup Compiler (ISCC.exe) on a workstation or build server, specifically targeting the v3.04, v3.06, or v3.07 module versions.

  • Filter/Exclusion: Exclude processes where the parent process is ISCC.exe or InnoSetup.exe and the file path contains \Inno Setup\ or \InnoSetup\. Additionally, exclude if the user belongs to a specific AD group like App_Developers or Build_Engineers.

• Scenario: An automated CI/CD pipeline (e.g., Jenkins, Azure DevOps, or GitHub Actions) runs a scheduled job that compiles installer packages for release candidates, invoking the Inno Setup compiler as part of the build script.

  • Filter/Exclusion: Exclude if the parent process is a known CI/CD agent (e.g., agent.exe, jenkins.exe, node.exe) or if the command line arguments contain keywords like --output, --log, or specific project paths associated with the build system.

• Scenario: A legacy internal application or utility that relies on Inno Setup for self-updates or component installations is triggered by a Windows Task Scheduler job during routine maintenance windows.

  • Filter/Exclusion: Exclude if the parent process is TaskScheduler.exe (or svchost.exe with the Schedule service) and the executable path matches known legacy application directories (e.g., C:\Program Files\InternalApp\).

• Scenario: A software vendor’s installer (e.g., for a specific database driver, SDK, or middleware) uses Inno Setup as its packaging engine and is executed by an end-user or via a GPO script