PKLITEv100c2

Hunt Hypothesis

This detection identifies the execution of a specific lightweight process or artifact matching the PKLITEv100c2 signature, which may indicate early-stage reconnaissance or the deployment of a benign utility by an adversary. Proactively hunting for this pattern in Azure Sentinel allows the SOC team to validate its legitimacy against known baselines and detect potential low-and-slow lateral movement that might otherwise be overlooked due to its low severity classification.

YARA Rule

rule PKLITEv100c2
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BA [2] A1 [2] 2D [2] 8C CB 81 C3 [2] 3B C3 77 ?? 05 [2] 3B C3 77 ?? B4 09 BA [2] CD 21 CD 20 90 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PKLITEv100c2 detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Microsoft Endpoint Configuration Manager (SCCM) Software Deployment

  • Context: The SCCM client service (ccmexec.exe) frequently launches pksetup.exe or similar installers to deploy applications like Adobe Acrobat, Office updates, or custom line-of-business tools. These installers often invoke the PKLite engine during the installation phase, triggering the YARA rule on endpoints where the installer is running as a scheduled task or user-initiated deployment.
  • Suggested Filter/Exclusion: Create an exclusion based on the parent process name ccmexec.exe and the file path containing \Microsoft Endpoint Configuration Manager\. Alternatively, filter out alerts where the command line contains /quiet or /install flags associated with known SCCM application IDs.

• Scenario: Antivirus Engine Scanning (CrowdStrike Falcon / Defender)

  • Context: Enterprise EDR solutions like CrowdStrike Falcon or Microsoft Defender often utilize PKLite components for their own heuristic scanning engines or real-time protection modules. When the AV engine scans a large directory or performs an on-demand scan, it may spawn child processes that match the YARA signature of PKLITEv100c2, causing alerts on every file access event within monitored directories.
  • Suggested Filter/Exclusion: Exclude process trees where the parent process is C:\Program Files\CrowdStrike\Falcon\csfalcon.exe or C:\Windows\System32\Microsoft Defender Antivirus\MsMpEng.exe. Additionally, add a path exclusion for files located within the AV vendor’s installation directories (e.g., \CrowdStrike\, \ProgramData\Microsoft\Windows Defender\).

• **Scenario: