InstallShieldCustom

Hunt Hypothesis

This detection identifies potential execution of custom InstallShield installers that may indicate an adversary leveraging legitimate software deployment mechanisms to establish persistence or deliver initial payloads within the environment. Proactive hunting for this behavior is essential in Azure Sentinel to distinguish between routine administrative installations and anomalous activity, ensuring early identification of supply chain compromises or stealthy malware introductions before they escalate into larger incidents.

YARA Rule

rule InstallShieldCustom
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 EC 44 56 FF 15 [2] 41 00 8B F0 85 F6 75 08 6A FF FF 15 [2] 41 00 8A 06 57 8B 3D [2] 41 00 3C 22 75 1B 56 FF D7 8B F0 8A 06 3C 22 74 04 84 C0 75 F1 80 3E 22 75 15 56 FF D7 8B }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the InstallShieldCustom detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Patch Deployment via SCCM/Intune

  • Context: Enterprise Configuration Management tools like Microsoft Endpoint Manager (formerly Intune) or System Center Configuration Manager (SCCM) frequently push application updates during maintenance windows. These deployments often utilize the InstallShield engine to install custom software packages, triggering the rule when the installer executable (setup.exe or isrt.dll) is executed by the system account.
  • Suggested Filter/Exclusion: Exclude processes where the parent process name matches ccmexec.exe (SCCM) or IntuneManagementExtension.exe, and the user context is NT AUTHORITY\SYSTEM. Alternatively, create a time-based exclusion to suppress alerts during defined maintenance windows (e.g., 02:00–04:00 daily).

• Scenario: Legitimate Software Installation by IT Helpdesk

  • Context: When an IT administrator manually installs standard enterprise applications (such as Adobe Acrobat, Oracle Java, or Microsoft Office) on a workstation via Remote Desktop Services (RDS), the InstallShield engine runs with elevated privileges. This is common during new hire onboarding or departmental software rollouts.
  • Suggested Filter/Exclusion: Create an exclusion based on the User field for specific administrative groups (e.g., DOMAIN\IT-Admins, DOMAIN\Helpdesk). Additionally, filter out events where the command line contains known product GUIDs or standard installer paths located in C:\Program Files\Common Files\InstallShield.

• Scenario: Automated Backup Agent Updates

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik often perform self-updates or install new agents on protected