Possible Execution of Windows MSIX Package Support Framework AI_STUBS (via process_creation)

title: Possible Execution of Windows MSIX Package Support Framework AI_STUBS (via process_creation)
id: 31ae2444-6034-577b-b35d-37705485968d
status: stable
description: This rule detects execution of Advanced Installer MSIX Package Support Framework (PSF) components, specifically AI_STUBS executables with original filename 'popupwrapper.exe'. This behavior may indicate hostile MSIX packages build with Advanced Installer abusing the Package Support Framework to bypass application control restrictions.
references:
    - https://attack.mitre.org/techniques/T1204/002/
    - https://attack.mitre.org/techniques/T1553/005/
    - https://attack.mitre.org/techniques/T1218/
    - https://redcanary.com/blog/threat-intelligence/msix-installers/
    - https://redcanary.com/threat-detection-report/techniques/installer-packages/
    - https://learn.microsoft.com/en-us/windows/msix/package/package-support-framework
    - https://www.splunk.com/en_us/blog/security/msix-weaponization-threat-detection-splunk.html
author: Huntrule Team
date: 2026-04-22
tags:
    - attack.execution
    - attack.stealth
    - attack.defense-impairment
    - attack.t1218
    - attack.t1553.005
    - attack.t1204.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\AI_STUBS\AiStubX64Elevated.exe'
            - '\AI_STUBS\AiStubX86Elevated.exe'
            - '\AI_STUBS\AiStubX64.exe'
            - '\AI_STUBS\AiStubX86.exe'
        OriginalFileName: 'popupwrapper.exe'
    condition: selection
falsepositives:
    - Unknown
level: low