PKLITE3211

Hunt Hypothesis

This detection identifies the presence of a specific lightweight executable or library component matching the PKLITE3211 signature, which may indicate early-stage adversary activity involving custom tooling or benign software deployment. Proactive hunting for this indicator in Azure Sentinel is essential to distinguish between legitimate operational artifacts and potential stealthy initial access mechanisms that could serve as a foothold for more advanced attacks.

YARA Rule

rule PKLITE3211
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20 31 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PKLITE3211 detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Microsoft Office Click-to-Run Updates

  • Context: The OfficeClickToRun.exe process frequently spawns child processes or modifies registry keys that match the PKLITE signature during routine monthly update cycles. This often occurs on workstations between 02:00 and 04:00 AM when users are inactive.
  • Filter/Exclusion: Create an exclusion based on the parent process name OfficeClickToRun.exe and restrict the rule to trigger only outside of the defined maintenance window (e.g., exclude events where ParentProcessName == 'OfficeClickToRun.exe' AND Hour >= 2 AND Hour <= 4).

• Scenario: Antivirus Scheduled Scans (Microsoft Defender)

  • Context: During scheduled full system scans, Microsoft Defender (MsMpEng.exe) utilizes various scanning engines that may instantiate temporary components or hooks resembling the PKLITE behavior. This is common on endpoint servers running daily deep scans.
  • Filter/Exclusion: Exclude events where the initiating process is MsMpEng.exe and the file path contains \Program Files\Microsoft Defender\. Alternatively, filter out alerts where the user context is NT SERVICE\MsMpSvc.

• Scenario: System Center Configuration Manager (SCCM) Deployment

  • Context: When SCCM (ccmsetup.exe or ccmexec.exe) pushes application deployments or software updates to endpoints, it often executes scripts that trigger the PKLITE3211 logic. This is particularly prevalent during “Business Hours” deployment windows for critical patches.
  • Filter/Exclusion: Add an exclusion rule targeting process names starting with `ccm