WiseInstallerStubv11010291

Hunt Hypothesis

This hypothesis targets the presence of the Wise Installer stub, a common component in legacy Windows software installations that adversaries may leverage to embed or execute malicious payloads within trusted installer processes. Proactively hunting for this artifact in Azure Sentinel helps identify potential supply chain compromises or unauthorized software deployments that could serve as a foothold for further lateral movement or privilege escalation.

YARA Rule

rule WiseInstallerStubv11010291
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE 80 38 22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A standard enterprise application (e.g., Adobe Creative Cloud, Oracle Java, or Symantec Endpoint Protection) is installed or updated using the Wise Installation Wizard (WisePC) packaging format. The installer executable is a self-extracting stub that matches the YARA signature for the specific version of the Wise Installer.

  • Filter/Exclusion: Exclude files located in standard installation directories (e.g., C:\Program Files\, C:\Program Files (x86)\) where the parent process is a known installer service (e.g., msiexec.exe, setup.exe, or install.exe) and the file extension is .exe. Additionally, exclude if the file path contains \Wise\ or \WisePC\ and the process command line includes arguments like /s (silent install) or /v4 (verbose).

• Scenario: An IT administrator performs a manual software deployment or repair using a legacy installer package created with WisePC v11.0.10291, often stored in a shared network drive or local temp folder (%TEMP% or %APPDATA%) before execution.

  • Filter/Exclusion: Exclude if the user account belongs to a privileged group (e.g., Domain Admins, IT Support, or Service Accounts) and the file is accessed from a known shared location (e.g., \\fileserver\apps\ or C:\Temp\) within a short time window (e.g., < 5 minutes) after creation. Correlate with event ID 4624 (Logon) for the same user to confirm interactive session.

• Scenario: A scheduled task or Group Policy Object (GPO) software installation job triggers the execution of a Wise-installed application’s update mechanism, which re-runs the original installer stub to verify