Detects Locky Ransomware (matches also on Win32/Kuluoz)

Hunt Hypothesis

This hunt targets adversary behavior characterized by the execution of known Locky or Kuluoz ransomware payloads to identify early-stage encryption activities before data exfiltration occurs. Proactively hunting for these signatures in Azure Sentinel is critical because their current low severity rating may cause them to be overlooked amidst high-volume noise, necessitating manual verification to prevent potential widespread data loss.

YARA Rule

rule Locky_Ransomware : ransom {
	meta:
		description = "Detects Locky Ransomware (matches also on Win32/Kuluoz)"
		author = "Florian Roth (with the help of binar.ly)"
		reference = "https://goo.gl/qScSrE"
		date = "2016-02-17"
		hash = "5e945c1d27c9ad77a2b63ae10af46aee7d29a6a43605a9bfbf35cebbcff184d8"
	strings:
		$o1 = { 45 b8 99 f7 f9 0f af 45 b8 89 45 b8 } // address=0x4144a7
		$o2 = { 2b 0a 0f af 4d f8 89 4d f8 c7 45 } // address=0x413863
	condition:
		all of ($o*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://goo.gl/qScSrE
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Locky Ransomware / Win32:Kuluoz detection rule in an enterprise environment, along with suggested filters or exclusions:

• Antivirus Engine Updates and Scans

  • Scenario: The endpoint protection agent (e.g., CrowdStrike Falcon, Microsoft Defender, or Symantec Endpoint Protection) initiates a definition update or a scheduled full system scan. During this process, the AV engine’s own scanning service (MsMpEng.exe, ccSvcHst.exe, or Cnsys.exe) accesses and temporarily locks thousands of files in common directories (like %TEMP% or C:\ProgramData), mimicking the rapid file access patterns associated with Locky.
  • Filter/Exclusion: Create a rule exclusion for processes matching known AV service names (MsMpEng.exe, ccSvcHst.exe) and restrict detection to non-standard user directories (excluding %TEMP%, %LOCALAPPDATA%\Temp, and the specific installation paths of the AV software).

• Enterprise Backup and Imaging Agents

  • Scenario: Scheduled backup jobs using tools like Veeam Agent, Commvault, or Acronis Cyber Protect run during off-hours. These agents perform heavy read/write operations on user home directories (C:\Users) to create snapshots or incremental backups. The high volume of file metadata changes and temporary lock states can trigger the heuristic logic for Win32:Kuluoz/Locky.
  • Filter/Exclusion: Exclude processes associated with major backup vendors (e.g., VeeamAgent.exe, SimAgent.exe, AcronisService.exe) from the detection rule. Additionally, add a time-based filter to suppress alerts for these specific process names during known maintenance windows (e.g., 02:00 – 05:00 local time