Windows: Detect Advanced Installer PSF AI_STUBS Executables with OriginalFileName popupwrapper.exe

title: "Windows: Detect Advanced Installer PSF AI_STUBS Executables with OriginalFileName popupwrapper.exe"
id: 9bb7207d-ea79-42b5-b18d-373788f3d42c
status: experimental
description: This rule identifies process execution on Windows where the image path ends with Advanced Installer Package Support Framework AI_STUBS executables and the process OriginalFileName is popupwrapper.exe. Attackers can abuse MSIX packaging components to run privileged or embedded helper stubs, potentially evading application control or maintaining stealth. Telemetry required includes process creation logs with the executed image path and OriginalFileName metadata.
references:
  - https://redcanary.com/blog/threat-intelligence/msix-installers/
  - https://redcanary.com/threat-detection-report/techniques/installer-packages/
  - https://learn.microsoft.com/en-us/windows/msix/package/package-support-framework
  - https://www.splunk.com/en_us/blog/security/msix-weaponization-threat-detection-splunk.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_msix_ai_stub_execution.yml
author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-03
tags:
  - attack.execution
  - attack.stealth
  - attack.defense-impairment
  - attack.t1218
  - attack.t1553.005
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - \AI_STUBS\AiStubX64Elevated.exe
      - \AI_STUBS\AiStubX86Elevated.exe
      - \AI_STUBS\AiStubX64.exe
      - \AI_STUBS\AiStubX86.exe
    OriginalFileName: popupwrapper.exe
  condition: selection
falsepositives:
  - Legitimate applications packaged with Advanced Installer using Package Support Framework
level: low
license: DRL-1.1
related:
  - id: af5732ed-764e-489d-826d-0447c8b36242
    type: derived