VIRUSIWormKLEZ

Hunt Hypothesis

This detection identifies the presence of the Klez worm malware, which is known for spreading via email attachments and exploiting network shares to establish persistence on endpoints. SOC teams should proactively hunt for this threat in Azure Sentinel because early identification allows for rapid containment before the worm can propagate laterally across the environment or exfiltrate sensitive data through its established command-and-control channels.

YARA Rule

rule VIRUSIWormKLEZ
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 40 D2 40 ?? 68 04 AC 40 ?? 64 A1 [4] 50 64 89 25 [4] 83 EC 58 53 56 57 89 65 E8 FF 15 BC D0 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the VIRUSIWormKLEZ detection rule in an enterprise environment, along with targeted filters and exclusions:

• Scenario: Legacy Antivirus Engine Updates

  • Context: The KLEZ worm signature often overlaps with generic file modification patterns found during scheduled updates of legacy on-premise antivirus solutions (e.g., Symantec Endpoint Protection or McAfee VirusScan Enterprise). When the engine downloads definition updates, it may spawn temporary processes that mimic the worm’s behavior.
  • Filter/Exclusion: Exclude file paths containing C:\Program Files\Symantec or C:\ProgramData\McAfee. Additionally, create a time-based filter to suppress alerts during the defined maintenance window (e.g., 02:00–04:00 UTC) when these updates are known to occur.

• Scenario: System Administrator Script Execution

  • Context: Administrators frequently use PowerShell or Python scripts to perform bulk user provisioning or file cleanup tasks. These scripts often invoke the wscript.exe host with specific command-line arguments that match the YARA rule’s heuristic for KLEZ propagation, particularly when processing large batches of .docx or .xlsx files in shared network drives.
  • Filter/Exclusion: Implement a process exclusion for powershell.exe and python.exe when launched by specific service accounts (e.g., DOMAIN\svc-admin-provisioning). Filter alerts where the parent process is taskeng.exe (Task Scheduler) and the command line contains keywords like “bulk” or “provision”.

• Scenario: Third-Party Backup Agent Operations

  • Context: Enterprise backup solutions such as Veeam Backup & Replication or Commvault utilize agents that scan and compress