PKLITEv114v115v1203

Hunt Hypothesis

This detection identifies the presence of specific Pklite library versions (114, 115, and 120) often associated with legitimate software but potentially leveraged by adversaries for persistence or data exfiltration. Proactive hunting in Azure Sentinel is recommended to distinguish these benign instances from anomalous usage patterns that could indicate early-stage compromise or supply chain attacks within the environment.

YARA Rule

rule PKLITEv114v115v1203
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [2] BA [2] 05 [2] 3B [3] 72 ?? B4 09 BA ?? 01 CD 21 CD 20 4E 6F }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PKLITEv114v115v1203 detection rule, along with recommended filters and exclusions:

• Scenario: Microsoft Office Click-to-Run Updates

  • Context: The YARA rule may flag the OfficeClickToRun.exe process when it downloads or installs cumulative updates (versions 114, 115, or 120). These executables often contain embedded PKLite signatures that match the detection logic.
  • Filter/Exclusion: Exclude processes where the command line contains OfficeClickToRun.exe and the file path is located within C:\Program Files\Microsoft Office\root\Office16.

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Enterprise AV solutions like CrowdStrike Falcon or Symantec Endpoint Protection frequently run scheduled jobs to fetch definition updates. The update agents often utilize PKLite libraries during the extraction phase, triggering the rule on the host machine.
  • Filter/Exclusion: Create a filter for processes named FalconSensor.exe (CrowdStrike) or Rtvscan64.exe (Symantec) running under the SYSTEM account during the defined maintenance window (e.g., 02:00 – 04:00).

• Scenario: System Center Configuration Manager (SCCM/MECM) Deployment

  • Context: When SCCM deploys application packages to endpoints, the ccmsetup.exe or WuaUla.exe processes often unpack compressed payloads containing PKLite components. This is common during large-scale patching cycles involving version 114-120 updates.
  • Filter/Exclusion: Exclude alerts where the parent process is `cc