NeoLite v10 additional

Hunt Hypothesis

This hypothesis targets the presence of NeoLite, a lightweight embedded SQL database often utilized by adversaries to store command-and-control data, configuration files, or stolen information locally without requiring a traditional database service. Proactively hunting for this artifact in Azure Sentinel helps identify low-and-slow persistence or data staging activities that may otherwise go unnoticed due to the tool’s minimal footprint and low severity classification.

YARA Rule

rule NeoLite_v10_additional: PEiD
{
    strings:
        $a = { 8B 44 24 04 23 05 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0 74 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Development teams using Visual Studio or Visual Studio Code with the C++ extension to compile and debug NeoLite database applications locally. The YARA rule may match the neolite.exe or associated DLLs loaded in the developer’s process tree during active debugging sessions.
  • Filter/Exclusion: Exclude processes where the parent process is devenv.exe (Visual Studio) or code.exe (VS Code) and the user account belongs to the DevTeam or Engineering security group.
• Scenario: Automated nightly backup jobs using Veeam Backup & Replication or Windows Server Backup that snapshot or copy the NeoLite database file (.neodb) while the application service is running. The YARA rule might trigger on the backup agent process reading the database file or the temporary copy created during the snapshot.
  • Filter/Exclusion: Exclude events where the source process is VeeamBackup.exe, wbadmin.exe, or vssadmin.exe and the destination path contains \Backup\ or \Snapshots\.
• Scenario: IT operations staff using Process Explorer or Sysinternals Suite to troubleshoot high CPU usage or memory leaks in the NeoLite service. The YARA rule may detect the NeoLite binary being inspected or loaded into the memory of the diagnostic tool.
  • Filter/Exclusion: Exclude processes where the parent process is procexp.exe or procmon.exe and the user account has the IT_Ops or SystemAdmins group membership.
• Scenario: Application deployment or patching via SCCM (System Center Configuration Manager) or WSUS where the NeoLite installer or update package is extracted and executed in a temporary directory (%TEMP% or C:\Windows\Temp) before