SetupFactoryv6003SetupLauncher

Hunt Hypothesis

This detection identifies the execution of the SetupFactoryv6003SetupLauncher process, which may indicate legitimate software installation or the initial stages of a supply chain compromise involving malicious installers. Proactively hunting for this behavior in Azure Sentinel is essential to distinguish between routine administrative updates and early-stage adversary activity that could leverage trusted setup mechanisms to establish persistence.

YARA Rule

rule SetupFactoryv6003SetupLauncher
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the SetupFactoryv6003SetupLauncher detection rule, including suggested filters and exclusions:

• Scenario: Scheduled Office 365 ProPlus Updates via Intune

  • Context: The Microsoft Endpoint Configuration Manager (Intune) or SCCM triggers a scheduled task to silently deploy or update Office applications. This process often invokes the SetupFactoryv6003SetupLauncher.exe as part of the Office Deployment Toolkit (ODT) chain during business hours.
  • Filter/Exclusion: Exclude processes where the parent process is Microsoft.Intune.Agent.exe or ccmexec.exe, and the command line contains keywords like /update, /silent, or specific ODT configuration XML paths (configuration.xml).

• Scenario: Automated Patching by SCCM Client Agent

  • Context: During the nightly maintenance window, the System Center Configuration Manager (SCCM) client executes a software update deployment. The SetupFactoryv6003SetupLauncher is launched to initialize the installation of cumulative updates for Microsoft Office or Visual Studio suites.
  • Filter/Exclusion: Create an exclusion rule based on the parent process name ccmexec.exe running within the standard maintenance window (e.g., 02:00 – 06:00 local time) and verify that the file hash of the launcher matches a known good baseline from the SCCM content library.

• Scenario: User-Initiated OneDrive or Teams Application Repair

  • Context: An end-user initiates an “Repair” action via the Windows Settings app for Microsoft 365 Apps. This triggers the local setup launcher to re-register components and fix missing dependencies, often appearing as a new process spawn from msiexec.exe or setup.exe.