Wise Installer Stub 11010291

Hunt Hypothesis

This hypothesis targets the presence of the Wise Installer Stub, a common component in legacy Windows software installations that adversaries may leverage to hide payloads or execute code within trusted installer processes. Proactively hunting for this artifact in Azure Sentinel helps identify potential supply chain compromises or unauthorized software deployments that could serve as a foothold for further lateral movement or privilege escalation.

YARA Rule

rule Wise_Installer_Stub_11010291: PEiD
{
    strings:
        $a = { 55 8B EC 81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE 80 38 22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Maintenance via Wise Package Studio

  • Scenario: An IT operations team uses Wise Package Studio to re-package or update a legacy line-of-business application (e.g., a custom ERP module or specialized engineering tool) that relies on the Wise installer framework. The stub file 11010291 is executed during the deployment or repair process on endpoint machines.
  • Filter/Exclusion: Exclude processes where the parent process is wisescript.exe or wisescript64.exe, or where the file path contains \Wise\ or \Wise Package Studio\.

• Scheduled Maintenance of Third-Party Vendor Tools

  • Scenario: A scheduled task (e.g., “VendorTool_Update” or “LegacyApp_Maintenance”) runs weekly to apply patches to a specific vendor-provided application that was originally installed using Wise Installer. The stub is invoked by the vendor’s update script or a custom PowerShell wrapper.
  • Filter/Exclusion: Exclude executions where the command line arguments contain specific vendor identifiers (e.g., /vendorname or /productid) or where the working directory matches the known installation path of the affected vendor software (e.g., C:\Program Files\VendorName\).

• Automated Image Building and Golden Image Deployment

  • Scenario: During the creation of a new Windows image for new employee laptops, the build script installs a set of standard applications. One of these applications uses the Wise installer, triggering the stub execution on the build server or during the Sysprep phase.
  • Filter/Exclusion: Exclude events originating from known image build servers (by hostname pattern, e.g., IMG-BUILD-*) or where the user account is a service account dedicated to imaging (e.g., svc_imaging or build_admin).