Chinese Hacktool Set - file klock.dll

Hunt Hypothesis

This hypothesis posits that adversaries are deploying the klock.dll component of a Chinese hacktool suite to establish persistence or perform reconnaissance within Azure environments. Proactive hunting for this specific artifact is critical because its low-severity classification may cause it to be overlooked by automated alerts, allowing attackers to maintain a stealthy foothold before escalating their activities.

YARA Rule

rule x64_klock {
	meta:
		description = "Chinese Hacktool Set - file klock.dll"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "44825e848bc3abdb6f31d0a49725bb6f498e9ccc"
	strings:
		$s1 = "Bienvenue dans un processus distant" fullword wide
		$s2 = "klock.dll" fullword ascii
		$s3 = "Erreur : le bureau courant (" fullword wide
		$s4 = "klock de mimikatz pour Windows" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 907KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file klock.dll detection rule, including suggested filters and exclusions:

• Endpoint Protection Agent Updates via Windows Task Scheduler

  • Scenario: Enterprise endpoints running Chinese security suites (e.g., Kingsoft Internet Security or 360 Total Security) often perform scheduled updates. The update process extracts klock.dll into the %ProgramFiles%\Kingsoft\KGuard directory and registers it as a kernel driver to monitor file system integrity during patch installation.
  • Filter/Exclusion: Create an exclusion for files located in known vendor directories (e.g., C:\Program Files\Kingsoft\*, C:\Program Files\360\*) where the parent process is the Windows Task Scheduler (svchost.exe or TaskSchedulerService) and the file hash matches a known benign version of klock.dll.

• IT Admin Deployment via SCCM/Intune Script Execution

  • Scenario: During a scheduled maintenance window, IT administrators deploy configuration scripts using Microsoft Endpoint Configuration Manager (SCCM) or Intuna. These scripts may extract utility files from a central repository to the local C:\Temp\Deploy folder. If the deployment package includes a Chinese localization tool or a specific hardware driver wrapper containing klock.dll, the rule triggers upon file creation and subsequent loading by the deployment agent (ccmexec.exe).
  • Filter/Exclusion: Exclude events where the parent process is ccmexec.exe (SCCM) or IntuneManagementExtension.exe and the file path contains standard deployment staging directories like \Temp\Deploy, \AppData\Local\Microsoft\EnterpriseContent, or specific network share paths used for software distribution.

• Legacy Chinese ERP Client Installation

  • Scenario: In multinational