Windows: Detect Advanced Installer PSF AI_STUBS Executables with OriginalFileName popupwrapper.exe
Flags Windows execution of Advanced Installer PSF AI_STUBS stubs where OriginalFileName equals popupwrapper.exe.
- Product
- windows
- Category
- process_creation
- Author
- Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-11-03
- Updated
- 2026-07-30
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process execution on Windows where the image path ends with Advanced Installer Package Support Framework AI_STUBS executables and the process OriginalFileName is popupwrapper.exe. Attackers can abuse MSIX packaging components to run privileged or embedded helper stubs, potentially evading application control or maintaining stealth. Telemetry required includes process creation logs with the executed image path and OriginalFileName metadata.
Reporting behind it
- redcanary.comhttps://redcanary.com/blog/threat-intelligence/msix-installers/
- redcanary.comhttps://redcanary.com/threat-detection-report/techniques/installer-packages/
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/msix/package/package-support-framework
- splunk.comhttps://www.splunk.com/en_us/blog/security/msix-weaponization-threat-detection-splunk.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_msix_ai_stub_execution.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Detect Advanced Installer PSF AI_STUBS Executables with OriginalFileName popupwrapper.exe"
id: 9bb7207d-ea79-42b5-b18d-373788f3d42c
status: experimental
description: This rule identifies process execution on Windows where the image path ends with Advanced Installer Package Support Framework AI_STUBS executables and the process OriginalFileName is popupwrapper.exe. Attackers can abuse MSIX packaging components to run privileged or embedded helper stubs, potentially evading application control or maintaining stealth. Telemetry required includes process creation logs with the executed image path and OriginalFileName metadata.
references:
- https://redcanary.com/blog/threat-intelligence/msix-installers/
- https://redcanary.com/threat-detection-report/techniques/installer-packages/
- https://learn.microsoft.com/en-us/windows/msix/package/package-support-framework
- https://www.splunk.com/en_us/blog/security/msix-weaponization-threat-detection-splunk.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_msix_ai_stub_execution.yml
author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-03
tags:
- attack.execution
- attack.stealth
- attack.defense-impairment
- attack.t1218
- attack.t1553.005
- attack.t1204.002
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \AI_STUBS\AiStubX64Elevated.exe
- \AI_STUBS\AiStubX86Elevated.exe
- \AI_STUBS\AiStubX64.exe
- \AI_STUBS\AiStubX86.exe
OriginalFileName: popupwrapper.exe
condition: selection
falsepositives:
- Legitimate applications packaged with Advanced Installer using Package Support Framework
level: low
license: DRL-1.1
related:
- id: af5732ed-764e-489d-826d-0447c8b36242
type: derived