SiliconRealmsInstallStub

Hunt Hypothesis

This rule detects the execution of the Silicon Realms install stub, a common component used by the Silicon Realms malware family to establish a foothold on host systems. Proactively hunting for this artifact in Azure Sentinel allows the SOC team to identify potential low-severity initial access or persistence mechanisms that may precede more advanced post-exploitation activities.

YARA Rule

rule SiliconRealmsInstallStub
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 ?? 92 40 00 68 [2] 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 [2] 40 00 33 D2 8A D4 89 15 [2] 40 00 8B C8 81 E1 FF 00 00 00 89 0D [2] 40 00 C1 E1 08 03 CA 89 0D [2] 40 00 C1 E8 10 A3 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: An IT administrator manually executes the SiliconRealms installer executable (e.g., setup.exe or install_stub.exe) from a mapped network drive or local admin share to deploy the software on a workstation.
  • Filter/Exclusion: Exclude processes where the parent process is explorer.exe or cmd.exe and the image path resides in a known administrative directory (e.g., C:\Admin\Tools\ or \\fileserver\it\tools\).
• Scenario: A Group Policy Object (GPO) or SCCM task sequence pushes the SiliconRealms installation package to endpoints, causing the install stub to run under the wuaexhost.exe (Windows Update) or CCMEXEC.EXE (SCCM Client) service context.
  • Filter/Exclusion: Exclude events where the parent process name is wuaexhost.exe, CCMEXEC.EXE, or msiexec.exe and the user context is NT AUTHORITY\SYSTEM or a dedicated service account.
• Scenario: A scheduled task created by the vendor for automatic updates or license verification triggers the install stub to run periodically in the background.
  • Filter/Exclusion: Exclude processes where the parent process is Svchost.exe (specifically the Task Scheduler service) or Taskengw.exe, and the command line contains arguments related to “update,” “verify,” or “license.”
• Scenario: A developer or QA engineer runs the SiliconRealms installer from a CI/CD pipeline agent or a local build server to test integration, often executing the stub directly from a temporary build directory.
  • Filter/Exclusion: Exclude processes where the image path contains keywords like build, temp, ci, or pipeline in the directory structure, or