ZipWorxSecureEXEv25ZipWORXTechnologiesLLC

Hunt Hypothesis

This detection identifies potential supply chain compromises or malicious document distribution by flagging files matching the specific signature of ZipWorx Technologies’ secure executable within the Azure Sentinel environment. Proactive hunting for this indicator is essential to validate legitimate software usage and distinguish it from adversary attempts to leverage trusted vendor artifacts as a cover for lateral movement or initial access attacks.

YARA Rule

rule ZipWorxSecureEXEv25ZipWORXTechnologiesLLC
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 B8 00 00 00 [12] 00 00 00 00 00 [10] 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the ZipWorxSecureEXEv25 detection rule, including recommended filters and exclusions:

• Scenario: Automated Backup Archiving via Windows Task Scheduler

  • Context: The enterprise utilizes a nightly scheduled job (e.g., Task Name: Daily_Doc_Archive) that invokes the ZipWorx executable to compress departmental reports into .zip files before moving them to an Azure Blob Storage container. The YARA rule triggers because the process creates temporary zip streams in the %TEMP% directory, mimicking suspicious archive creation behavior.
  • Filter/Exclusion: Add a path-based exclusion for the specific task executable location: C:\Program Files\ZipWorx Technologies\SecureEXE\bin\ZwArchive.exe. Additionally, exclude processes where the parent process is svchost.exe (specifically the “Task Scheduler” service) and the command line contains -task Daily_Doc_Archive.

• Scenario: Deployment of Software Updates via SCCM/Intune

  • Context: During a monthly patching window, Microsoft Endpoint Configuration Manager (SCCM) or Intune deploys a new version of internal productivity tools. The deployment agent extracts the installer package using ZipWorx as an intermediate step to unpack nested archives before execution. This triggers the rule due to the high volume of file I/O and memory mapping operations performed by the tool during extraction.
  • Filter/Exclusion: Create a whitelist for processes spawned by ccmsetup.exe (SCCM) or Microsoft.Intune.AgentService. The exclusion logic should target the specific hash of the ZipWorx executable version 25.x (SHA256: [Insert_Hash]) when running under these parent processes.

• **Scenario: User-Initiated Document Merging in Shared