Chinese Hacktool Set - file klock.dll

Hunt Hypothesis

This hypothesis posits that adversaries are deploying the klock.dll component of a Chinese hack tool suite to establish persistence or perform reconnaissance on endpoints within the Azure environment. Proactively hunting for this specific artifact is critical because its low severity classification may cause it to be overlooked in standard alerting, allowing threat actors to maintain a stealthy foothold before escalating their activities.

YARA Rule

rule Win32_klock {
	meta:
		description = "Chinese Hacktool Set - file klock.dll"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "7addce4434670927c4efaa560524680ba2871d17"
	strings:
		$s1 = "klock.dll" fullword ascii
		$s2 = "Erreur : impossible de basculer le bureau ; SwitchDesktop : " fullword wide
		$s3 = "klock de mimikatz pour Windows" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 250KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file klock.dll detection rule, including suggested filters and exclusions:

• Scenario: Deployment of Kaspersky Endpoint Security (or similar Chinese-origin AV suites)

  • Context: The klock.dll file is a core component often associated with the “KLock” utility within Kaspersky security products or specific Chinese hardware management tools. If an enterprise deploys Kaspersky Endpoint Security for Business, the installation or update process will write this DLL to the system directory (C:\Program Files\Kaspersky Lab\...) and load it into memory.
  • Suggested Filter/Exclusion: Create a whitelist rule excluding file paths containing Kaspersky Lab, Kaspersky, or specific known SHA-256 hashes of legitimate klock.dll versions from the vendor’s official repository. Additionally, exclude network traffic originating from the internal IP range of the patch management server (e.g., WSUS or SCCM) during maintenance windows.

• Scenario: Scheduled Group Policy Software Installation

  • Context: In many large enterprises, a specific Chinese-origin hardware monitoring tool (often bundled with device lifecycle management software like “Huawei Device Manager” or similar OEM utilities) is pushed via Group Policy Objects (GPO) to all workstations. The klock.dll file is extracted and registered by the scheduled task \Microsoft\Windows\DeviceManagement\InstallTask during the nightly 2:00 AM maintenance window, triggering a “new file creation” alert.
  • Suggested Filter/Exclusion: Exclude events where the parent process is gpupdate.exe, msiexec.exe, or taskeng.exe running under the SYSTEM account context. Furthermore, add a time-based filter to suppress alerts for this specific DLL during defined maintenance windows