Counterfeit Installer Campaign: Detecting and Blocking Trojanized Software Downloads with Microsoft Defender XDR

---
title: Installer Executed From User Downloads or Temp Directory Spawning Scripting Engine
id: 3f9c1a2e-7b84-4d51-9a2c-5e6f7a8b9c0d
status: experimental
description: Detects installers executed from user-writable download locations spawning script interpreters or LOLBins, consistent with trojanized installer staging behavior observed in counterfeit software download campaigns.
references:
  - https://www.microsoft.com/en-us/security/blog/2026/09/01/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign/
  - https://attack.mitre.org/techniques/T1204/002/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/02
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
      - '\AppData\Local\Microsoft\Windows\INetCache\'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  filter_sccm:
    ParentImage|contains: 'C:\Windows\ccmcache\'
  condition: selection_parent and selection_child and not filter_sccm
falsepositives:
  - Legitimate software installers that run post-install scripts (e.g., browser updaters, Node.js installers)
  - Enterprise packaging tools — allowlist known deployment paths
level: high
---
title: Scheduled Task Created by Process Running From User-Writable Path
id: 8b2e4f61-3c97-4a18-b5d3-9f0e1a2b3c4d
status: experimental
description: Detects schtasks or Register-ScheduledTask execution from binaries in user-writable locations, a persistence technique observed following trojanized installer execution in counterfeit download campaigns.
references:
  - https://www.microsoft.com/en-us/security/blog/2026/09/01/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign/
  - https://attack.mitre.org/techniques/T1053/005/
author: Security Arsenal
date: 2026/09/02
tags:
  - attack.persistence
  - attack.t1053.005
  - attack.privilege_escalation
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: '\schtasks.exe'
  selection_cmd:
    CommandLine|contains:
      - '/create'
      - '/tn'
  selection_suspicious_payload:
    CommandLine|contains:
      - '\AppData\'
      - '\Users\Public\'
      - '\ProgramData\'
      - '\Temp\'
  filter_admin:
    User|contains: 'SYSTEM'
  condition: selection_img and selection_cmd and selection_suspicious_payload and not filter_admin
falsepositives:
  - Legitimate application updaters registering maintenance tasks (e.g., browser and conferencing clients) — tune per approved software list
level: high
---
title: Msiexec Installing Package From Non-Standard or User-Writable Location With External URL
id: c47d2a91-5e63-4f08-a1b7-2d4e6f8a0c1b
status: experimental
description: Detects msiexec installing packages directly from URLs or user-writable paths, consistent with delivery of regenerated malicious installer archives from look-alike vendor download pages.
references:
  - https://www.microsoft.com/en-us/security/blog/2026/09/01/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign/
  - https://attack.mitre.org/techniques/T1218/007/
author: Security Arsenal
date: 2026/09/02
tags:
  - attack.defense_evasion
  - attack.t1218.007
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: '\msiexec.exe'
  selection_url:
    CommandLine|contains:
      - 'http://'
      - 'https://'
  selection_local:
    CommandLine|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
      - '\Users\Public\'
  condition: selection_img and (selection_url or selection_local)
falsepositives:
  - Legitimate web-based MSI deployments and enterprise app catalogs — allowlist known distribution URLs and internal shares
level: medium

let SuspiciousChildren = dynamic(["powershell.exe","pwsh.exe","cmd.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","schtasks.exe","bitsadmin.exe","certutil.exe"]);
let UserWritablePaths = dynamic(["\\Downloads\\","\\AppData\\Local\\Temp\\","\\AppData\\Local\\Microsoft\\Windows\\INetCache\\","\\Users\\Public\\"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ (SuspiciousChildren)
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FolderPath has_any (UserWritablePaths)
    | where FileName endswith ".exe" or FileName endswith ".msi"
    | project ParentTime=TimeGenerated, DeviceId, InitiatingProcessId=ProcessId, InstallerName=FileName, InstallerPath=FolderPath, InstallerCmd=ProcessCommandLine, InstallerSHA256=SHA256
) on $left.ProcessId == $right.InitiatingProcessId and $left.DeviceId == $right.DeviceId
| where TimeGenerated between (ParentTime .. ParentTime + 10m)
| join kind=leftouter (
    DeviceFileCertificateInfo
    | summarize arg_max(TimeGenerated, *) by SHA256
    | project SHA256, Signer, IsTrusted, IsRootSignerMicrosoft
) on $left.InstallerSHA256 == $right.SHA256
| extend UnsignedOrUntrusted = iff(IsTrusted == true, 0, 1)
| project ChildTime=TimeGenerated, DeviceName, AccountName, InstallerName, InstallerPath, InstallerCmd, ChildProcess=FileName, ChildCmd=ProcessCommandLine, Signer, IsTrusted, InstallerSHA256
| order by ChildTime desc

let Lookback = 7d;
let RecentDownloads = DeviceFileEvents
    | where TimeGenerated > ago(Lookback)
    | where FolderPath has_any ("\\Downloads\\", "\\AppData\\Local\\Temp\\")
    | where FileName endswith_any (".exe",".msi",".zip",".iso")
    | project DownloadTime=TimeGenerated, DeviceId, DeviceName, DownloadedFile=FileName, SHA256;
DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where RemoteUrl != "" and ActionType == "ConnectionSuccess"
| join kind=inner RecentDownloads on DeviceId
| where TimeGenerated between (DownloadTime .. DownloadTime + 30m)
| where InitiatingProcessFolderPath has_any ("\\Downloads\\", "\\AppData\\", "\\ProgramData\\", "\\Users\\Public\\")
| summarize Connections=count(), DistinctURLs=dcount(RemoteUrl), URLs=make_set(RemoteUrl, 20) by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, DownloadedFile, bin(TimeGenerated, 1h)
| order by Connections desc

-- Hunt: TrojInstallerUserPathExec
-- Finds recently created executables in user-writable locations and correlates
-- with running/spawned processes to surface trojanized installer staging.

LET recent_files = SELECT FullPath, Mtime, Size
FROM glob(globs=['C:/Users/*/Downloads/*.exe',
                 'C:/Users/*/Downloads/*.msi',
                 'C:/Users/*/AppData/Local/Temp/*.exe',
                 'C:/Users/Public/*.exe',
                 'C:/ProgramData/*.exe'])
WHERE Mtime > now() - (7 * 24 * 3600)

SELECT FullPath AS SuspiciousBinary,
       Mtime AS WrittenTime,
       Size,
       Pid,
       Name AS RunningProcessName,
       CommandLine AS ProcessCommandLine,
       Username AS ProcessOwner,
       CreateTime AS ProcessStartTime
FROM pslist()
WHERE Exe IN (SELECT FullPath FROM recent_files)
   OR CommandLine =~ '(?i)(Downloads|AppData\\Local\\Temp|Users\\Public).+\.(exe|msi|dll)'
ORDER BY WrittenTime DESC

# Triage script: counterfeit installer campaign
# Run elevated on suspected hosts. Read-only — collects evidence, does not remediate.

$report = @()
$cutoff = (Get-Date).AddDays(-7)

# 1. Recently written executables/MSIs in user-writable locations
$paths = @("$env:SystemDrive\Users\*\Downloads", "$env:SystemDrive\Users\Public", "$env:SystemDrive\ProgramData")
$files = foreach ($p in $paths) {
    Get-ChildItem -Path $p -Include *.exe,*.msi,*.dll,*.ps1,*.bat -Recurse -ErrorAction SilentlyContinue |
    Where-Object { $_.CreationTime -gt $cutoff }
}

foreach ($f in $files) {
    $sig = Get-AuthenticodeSignature -FilePath $f.FullName
    $hash = (Get-FileHash -Path $f.FullName -Algorithm SHA256).Hash
    $report += [PSCustomObject]@{
        Type      = 'File'
        Path      = $f.FullName
        Created   = $f.CreationTime
        SigStatus = $sig.Status
        Signer    = $sig.SignerCertificate.Subject
        SHA256    = $hash
    }
}

# 2. Scheduled tasks created in the last 7 days by non-system principals
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    if ($_.Date -and ([datetime]$_.Date) -gt $cutoff -and $_.Principal.UserId -notmatch 'SYSTEM|LOCAL SERVICE|NETWORK SERVICE') {
        $report += [PSCustomObject]@{
            Type      = 'ScheduledTask'
            Path      = $_.TaskPath + $_.TaskName
            Created   = $_.Date
            SigStatus = 'N/A'
            Signer    = $_.Principal.UserId
            SHA256    = ($_.Actions | ForEach-Object { $_.Execute + ' ' + $_.Arguments }) -join '; '
        }
    }
}

# 3. Run key entries pointing at user-writable paths
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($rk in $runKeys) {
    $props = Get-ItemProperty -Path $rk -ErrorAction SilentlyContinue
    if ($props) {
        $props.PSObject.Properties | Where-Object { $_.Value -match 'AppData|Users\\Public|Temp' } | ForEach-Object {
            $report += [PSCustomObject]@{
                Type      = 'RunKey'
                Path      = "$rk\$($_.Name)"
                Created   = 'N/A'
                SigStatus = 'Review'
                Signer    = $env:USERNAME
                SHA256    = $_.Value
            }
        }
    }
}

$report | Format-Table -AutoSize
$report | Export-Csv -Path ".\installer-triage-$(Get-Date -Format 'yyyyMMdd-HHmm').csv" -NoTypeInformation

# Flag unsigned binaries explicitly
$unsigned = $report | Where-Object { $_.Type -eq 'File' -and $_.SigStatus -ne 'Valid' }
if ($unsigned) {
    Write-Warning "$(@($unsigned).Count) unsigned/invalid executables found in user-writable paths. Escalate to IR."
}