This detection rule identifies potential malicious activity associated with the specific YARA signature PKZIPSFXv11198990, which targets known patterns in compressed archive files that may indicate stealthy data exfiltration or malware delivery. A proactive hunt is essential within Azure Sentinel to validate these low-severity alerts against broader context, ensuring that subtle threats embedded in ZIP archives are not overlooked before they escalate into significant incidents.
rule PKZIPSFXv11198990
{
meta:
author="malware-lu"
strings:
$a0 = { FC 2E 8C 0E [2] A1 [2] 8C CB 81 C3 [2] 3B C3 72 ?? 2D [2] 2D [2] FA BC [2] 8E D0 FB }
condition:
$a0 at pe.entry_point
}
This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Here are 5 specific false positive scenarios for the PKZIPSFXv11198990 detection rule, including suggested filters and exclusions tailored for an enterprise environment:
Scenario: Automated Backup Archives by Veeam or Commvault
.zip or compressed archive files containing system state data and logs. These archives often contain embedded signatures that match the PKZIPSFX pattern due to standard compression algorithms used by the backup software.Veeam.Backup.Service.exe (or commvault.cmd) and exclude file paths matching C:\ProgramData\Veeam\Backup\Archives\*.Scenario: Scheduled Software Deployment via SCCM or Intune
.zip containers to endpoints. During the extraction phase, the deployment agent creates temporary zip structures that trigger this rule before the final installation completes.ccmsetup.exe, Microsoft.IntuneManagementAgent.exe, and file paths under C:\Windows\CCM\Logs or C:\ProgramData\Microsoft Intune Management Extension.Scenario: Log Aggregation by Splunk Universal Forwarder
.zip bundles before transmission to the central collector. This compression activity is a routine housekeeping task that mimics the behavior of the detection rule.splunkd.exe (or