InstallAnywhere61ZeroGSoftwareInc

Hunt Hypothesis

This hypothesis targets the execution of the InstallAnywhere installer (version 6.1) by ZeroG Software Inc., a component frequently leveraged in supply chain attacks or as a persistence mechanism within compromised Azure environments. Proactively hunting for this specific artifact allows the SOC to identify potential unauthorized software installations or staging activities that may precede more advanced post-exploitation actions.

YARA Rule

rule InstallAnywhere61ZeroGSoftwareInc
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 }
	$a1 = { 60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: An IT administrator manually deploys a legacy Java-based application (e.g., a specific version of SAP GUI or Oracle Client) that utilizes the InstallAnywhere 6.1 installer framework via a double-click on the setup.exe or install.exe binary from a mapped network drive or local temp folder.

  • Filter/Exclusion: Exclude processes where the parent process is explorer.exe or cmd.exe and the file path contains \InstallAnywhere\ or matches known legacy vendor directories (e.g., \SAP\, \Oracle\), provided the user is in the Domain Admins or IT_Support group.

• Scenario: A scheduled maintenance task (e.g., a Task Scheduler job named Weekly_App_Patch) runs a silent installation script for a third-party monitoring agent (e.g., Dynatrace or AppDynamics) that bundles the InstallAnywhere 6.1 runtime, executing from the C:\ProgramData\ or C:\Windows\Temp\ directory.

  • Filter/Exclusion: Exclude executions where the parent process is svchost.exe (specifically LocalService or NetworkService) or taskschd.exe, and the working directory is within standard system data paths like C:\ProgramData\ or C:\Windows\Temp\.

• Scenario: A developer or QA engineer runs a local build or test environment that includes a legacy Java application (e.g., Eclipse IDE plugin or a custom internal tool) which relies on the InstallAnywhere 6.1 framework for component updates, executed directly from a user profile directory like C:\Users\<username>\AppData\Local\.

  • Filter/Exclusion: Exclude processes where the file path resides within `C:\Users\