PKLITEv112v115v1202

Hunt Hypothesis

This detection identifies the execution of a specific PKLite utility variant (versions 112, 115, and 120) that adversaries may leverage to perform lightweight package management or obfuscate malicious payloads during initial access phases. A proactive hunt is recommended within Azure Sentinel to establish a baseline for this legitimate tool’s usage patterns, enabling the SOC team to distinguish between normal administrative activity and potential abuse by threat actors attempting to blend in with standard system operations.

YARA Rule

rule PKLITEv112v115v1202
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [2] BA [2] 3B C4 73 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the PKLITEv112v115v1202 YARA rule detection, including targeted filters and exclusions:

• Scenario: Microsoft Office Click-to-Run (C2R) Background Updates

  • Context: The OfficeClickToRun.exe process frequently spawns child processes or extracts temporary packages that match the PKLite signature during scheduled update cycles. This often occurs on user workstations between 01:00 and 05:00 AM.
  • Filter/Exclusion: Create a whitelist rule excluding any detection where the parent process is OfficeClickToRun.exe (PID > 1) AND the file path contains \Microsoft Office ClickToRun\. Alternatively, exclude the specific hash of the update agent if known.

• Scenario: Antivirus Engine Scanning via Windows Defender

  • Context: During full system scans or on-access scanning, MsMpEng.exe (Windows Defender) often unpacks compressed archives containing PKLite components to inspect them. The YARA rule may trigger when the scanner extracts these temporary files into the %TEMP% directory.
  • Filter/Exclusion: Exclude detections where the parent process is MsMpEng.exe and the file location resides within C:\ProgramData\Microsoft\Windows Defender\Platform\.

• Scenario: Scheduled Task Execution for Software Deployment (SCCM/Intune)

  • Context: Enterprise deployment tools like Microsoft Endpoint Configuration Manager (SCCM) or Intune utilize PKLite-based installers to push software updates. When the “System” account runs a scheduled task to deploy an application, the installer executable matches the rule signature.
  • Filter/Exclusion: Filter out events where the User field is NT AUTHORITY\SYSTEM AND the command