Setup2GoInstallerStub

Hunt Hypothesis

This rule detects the presence of Setup2Go installer stubs, which are often used by adversaries to stage payloads or execute initial access mechanisms via legitimate installer frameworks. Proactively hunting for these artifacts allows the SOC to identify potential supply chain compromises or hidden persistence mechanisms that may evade standard behavioral detections in the Azure Sentinel environment.

YARA Rule

rule Setup2GoInstallerStub
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 5B 53 45 54 55 50 5F 49 4E 46 4F 5D 0D 0A 56 65 72 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legitimate Software Deployment via SCCM/Intune: When deploying applications like Adobe Creative Cloud, Microsoft Office, or Java using the Setup2Go framework (common in Citrix or virtual desktop environments), the installer stub executes to bootstrap the actual installation. Filter: Exclude processes where the parent process is ccmsetup.exe (SCCM Client) or IntuneManagementExtension.exe, or where the command line contains arguments like /install or /silent from known software vendors.
• Citrix Virtual Apps and Desktops Provisioning: In VDI or DaaS environments, Setup2Go is frequently used to install or update applications on virtual machines during provisioning or maintenance windows. Filter: Exclude executions originating from Citrix-specific services such as Cvtray.exe, Cvtray64.exe, or CvtrayAgent.exe, or where the working directory resides under C:\Program Files\Citrix\.
• Java Runtime Environment (JRE/JDK) Updates: Java installers often utilize Setup2Go for modular updates or initial installations in enterprise Java application servers. Filter: Exclude processes where the executable path contains java or jre, or where the parent process is java.exe, javaw.exe, or a service control manager (services.exe) running the Java Update Service.
• Adobe Creative Cloud or Reader Updates: Adobe products frequently use Setup2Go for background updates or initial installations in enterprise fleets. Filter: Exclude processes where the parent process is AdobeUpdateService.exe, Creative Cloud.exe, or Reader.exe, or where the file path includes Adobe or Creative Cloud.
• Scheduled Maintenance Tasks for Third-Party Enterprise Apps: Applications like SAP, Oracle, or custom internal tools may use Setup2Go for patching during scheduled maintenance windows. Filter: Exclude executions triggered by Task Scheduler (`tasks