Sunturai
Back to results
MediumSplunk security contentMichael Haag +1

Windows Advanced Installer MSIX with AI_STUBS Execution

The following analytic identifies the execution of Advanced Installer MSIX Package Support Framework (PSF) components, specifically the AI_STUBS executables with the original filename 'popupwrapper.exe'. This…

Description

The following analytic identifies the execution of Advanced Installer MSIX Package Support Framework (PSF) components, specifically the AI_STUBS executables with the original filename 'popupwrapper.exe'. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process paths and original filenames. This activity is significant as adversaries have been observed packaging malicious content within MSIX files built with Advanced Installer to bypass security controls. These AI_STUBS executables (with original filename 'popupwrapper.exe') are hallmark artifacts of potentially malicious MSIX packages. If confirmed malicious, this could allow attackers to execute arbitrary code, establish persistence, or deliver malware while evading traditional detection mechanisms.

Detection logic

Detection requirements

Platform
LinuxmacOSWindows

The rule states no platform. This is derived from the 3 ATT&CK techniques it maps to.

Log source category
crowdstrike_processrollup2sysmon_eventid_1windows_event_log_security_4688

Known benign triggers

  • Legitimate applications packaged with Advanced Installer using the Package Support Framework may trigger this detection. Verify if the MSIX package is from a trusted source and signed by a trusted publisher before taking action. Organizations that use Advanced Installer for legitimate software packaging may see false positives.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice