PKLITEv100v103

Hunt Hypothesis

This rule detects the presence of PKLite, a lightweight SQLite database engine, which adversaries may embed in custom tools or malware to store configuration data, logs, or stolen information locally without relying on standard file system artifacts. Proactively hunting for this signature helps the SOC identify low-fidelity persistence mechanisms or data staging activities that might otherwise go unnoticed due to the library’s small footprint and common use in legitimate applications.

YARA Rule

rule PKLITEv100v103
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [2] BA [2] 8C DB 03 D8 3B }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of pklite.exe by the SQL Server Maintenance Plan or Database Engine Tuning Advisor during routine database optimization or backup verification tasks.
  • Filter/Exclusion: Exclude if the parent process is sqlservr.exe or sqlagent.exe and the file path matches C:\Program Files\Microsoft SQL Server\*\*\\Shared Tools\100\Tools\Binn\pklite.exe (or similar standard SQL installation paths).
• Scenario: Visual Studio or Visual Studio Code (with C++ extensions) invoking pklite.exe as part of the IntelliSense database update or CMake build configuration process for C++ projects.
  • Filter/Exclusion: Exclude if the parent process is devenv.exe (Visual Studio) or code.exe (VS Code) and the working directory contains CMakeLists.txt or *.vcxproj files, or if the command line arguments include keywords like update or rebuild.
• Scenario: Oracle Database installation or upgrade scripts running pklite.exe to manage XML metadata or schema objects during the dbca (Database Configuration Assistant) or netca (Net Configuration Assistant) execution.
  • Filter/Exclusion: Exclude if the parent process is java.exe (commonly used by Oracle tools) or dbca.exe/netca.exe, and the file path resides under C:\Oracle\ or C:\app\ directories.
• Scenario: SAP NetWeaver or SAP HANA client tools using pklite.exe for XML parsing in configuration files or log analysis during system health checks or patching.