Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Windows MSIX Package Support Framework AI_STUBS Execution

Detects execution of Advanced Installer MSIX Package Support Framework (PSF) components, specifically AI_STUBS executables with original filename 'popupwrapper.exe'. This activity may indicate malicious MSIX packages build with Advanced Installer leveraging the Package Support Framework to bypass application control restrictions.

ATT&CK coverage

Outside the enterprise matrix

Detection requirements

Log source product: windows
Log source category: process_creation

What the source says

What fires this without an attack behind it

Legitimate applications packaged with Advanced Installer using Package Support Framework

References

Tagged by the source as

attack.defense-impairmentattack.executionattack.stealth

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.