Windows: Detect Advanced Installer PSF AI_STUBS Executables with OriginalFileName popupwrapper.exe

Flags Windows execution of Advanced Installer PSF AI_STUBS stubs where OriginalFileName equals popupwrapper.exe.

FreeReviewedSigma · Low · v1

Product: windows
Category: process_creation
Author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2025-11-03
Updated: 2026-07-30

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1204.002Malicious File
Persistence
Priv Esc
Defense Evasion
- T1218System Binary Proxy Execution
- T1553.005Mark-of-the-Web Bypass
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process execution on Windows where the image path ends with Advanced Installer Package Support Framework AI_STUBS executables and the process OriginalFileName is popupwrapper.exe. Attackers can abuse MSIX packaging components to run privileged or embedded helper stubs, potentially evading application control or maintaining stealth. Telemetry required includes process creation logs with the executed image path and OriginalFileName metadata.

Reporting behind it

Related detections9 linkedT1204.002 — drag to rearrange

Suspicious Program Execution From a Mounted ISO or Disk Image (via process_creation)

Malicious more_eggs LOLBIN Scriptlet Execution via ie4uinit BaseSettings Abuse (via process_creation)

Suspicious FileFix TypedPaths Entry Containing PowerShell or URL

Suspicious VBA Runtime Loaded by Process from OneNote Exported Directory

Suspicious vbc.exe Spawned by Installer Process

Suspicious n8n Campaign RMM Installer Masquerading as OneDrive Document

Suspicious NFe-Themed Brazilian Lure Executable Execution

Suspicious Executable Dropped in Public Users Directory Named Ctrlpanel (via file_event)

Suspicious Cabinet Extraction of Masqueraded vstm Archive via extrac32

Windows: Detect Advanced Installer PSF AI_STUBS Executables with OriginalFileName popupwrapper.exe

Pivot detection · T1204.002 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-detect-advanced-installer-psf-ai-stubs-executables-with-originalfilename-af5732ed

title: "Windows: Detect Advanced Installer PSF AI_STUBS Executables with OriginalFileName popupwrapper.exe"
id: 9bb7207d-ea79-42b5-b18d-373788f3d42c
status: experimental
description: This rule identifies process execution on Windows where the image path ends with Advanced Installer Package Support Framework AI_STUBS executables and the process OriginalFileName is popupwrapper.exe. Attackers can abuse MSIX packaging components to run privileged or embedded helper stubs, potentially evading application control or maintaining stealth. Telemetry required includes process creation logs with the executed image path and OriginalFileName metadata.
references:
  - https://redcanary.com/blog/threat-intelligence/msix-installers/
  - https://redcanary.com/threat-detection-report/techniques/installer-packages/
  - https://learn.microsoft.com/en-us/windows/msix/package/package-support-framework
  - https://www.splunk.com/en_us/blog/security/msix-weaponization-threat-detection-splunk.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_msix_ai_stub_execution.yml
author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-03
tags:
  - attack.execution
  - attack.stealth
  - attack.defense-impairment
  - attack.t1218
  - attack.t1553.005
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - \AI_STUBS\AiStubX64Elevated.exe
      - \AI_STUBS\AiStubX86Elevated.exe
      - \AI_STUBS\AiStubX64.exe
      - \AI_STUBS\AiStubX86.exe
    OriginalFileName: popupwrapper.exe
  condition: selection
falsepositives:
  - Legitimate applications packaged with Advanced Installer using Package Support Framework
level: low
license: DRL-1.1
related:
  - id: af5732ed-764e-489d-826d-0447c8b36242
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL