This detection identifies the execution of 32-bit or 64-bit WinZip processes to uncover potential adversary use of legitimate compression tools for payload delivery or data exfiltration. SOC teams should proactively hunt for this activity in Azure Sentinel to distinguish between routine administrative usage and suspicious instances where attackers leverage trusted applications to bypass security controls.
rule WinZip32bit6x
{
meta:
author="malware-lu"
strings:
$a0 = { FF 15 FC 81 40 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 }
condition:
$a0 at pe.entry_point
}
This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Here are 5 specific false positive scenarios for the WinZip32bit6x detection rule, including suggested filters and exclusions:
Scenario: Automated Backup Scripts Executing Legacy Archivers
SYSTEM account during off-hours, triggering the rule despite being benign.\Program Files (x86)\WinZip\ where the parent process is vss.exe, powershell.exe, or veeamagent.exe. Additionally, filter out events occurring between 01:00 and 05:00 UTC.Scenario: Deployment of Patched Software via SCCM/Intune
winzip.exe to unpack the payload.ccmsetup.exe, Microsoft.IntuneManagementAgent.exe, or wuauserv. Filter specifically for instances where the command line arguments contain keywords like /quiet, /install, or specific package GUIDs known to use WinZip.Scenario: User-Initiated Document Archiving in Shared Drives