LOCK98V10028keenvim

Hunt Hypothesis

This hypothesis targets the presence of the “keenvim” YARA signature, which likely indicates the deployment of a specific malware variant or tooling associated with the LOCK98V10028 identifier. Proactively hunting for this low-severity indicator in Azure Sentinel allows the SOC team to identify early-stage footholds or dormant payloads that may be used for lateral movement or data staging before they escalate to higher-impact activities.

YARA Rule

rule LOCK98V10028keenvim
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 E8 00 00 00 00 5D 81 [5] EB 05 E9 [4] EB 08 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses the vim text editor to edit configuration files (e.g., nginx.conf, docker-compose.yml) on a Linux application server or build agent. Since vim is a standard interactive editor, its presence in process memory or file system scans is expected.
  • Filter/Exclusion: Exclude processes where the parent process is a shell (bash, sh, zsh) or an IDE terminal, and restrict the exclusion to non-domain-joined Linux hosts or specific user groups (e.g., dev-team, ops-team).
• Scenario: An automated CI/CD pipeline or scheduled cron job uses vim in “ex mode” (e.g., vim -es) to perform non-interactive text substitutions or file modifications as part of a build or deployment script. This is a common pattern in legacy scripts or specific tooling that relies on vim for scripting.
  • Filter/Exclusion: Exclude instances where the vim process is invoked with the -es (ex mode) or -e flags, or where the parent process is a known CI/CD agent (e.g., jenkins-agent, gitlab-runner, github-actions-runner).
• Scenario: A system administrator performs routine maintenance on a Linux bastion host or jump server, using vim to edit system configuration files such as /etc/hosts, /etc/ssh/sshd_config, or log rotation scripts. This is a standard administrative task on Linux infrastructure.
  • Filter/Exclusion: Exclude vim processes on hosts designated as “bastion” or “jump-host” in your CMDB, or exclude if the user is a member of the sudo or wheel group on Linux systems.
• Scenario: A security team or incident responder uses vim to