PKLITEv114v120

Hunt Hypothesis

This hypothesis targets the presence of PKLite, a lightweight SQLite database engine, which adversaries may embed in custom tools or malware to store configuration data, credentials, or exfiltrated information locally without relying on standard OS databases. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify potentially stealthy persistence or data staging mechanisms that might otherwise go unnoticed due to the low severity and lack of specific MITRE mapping.

YARA Rule

rule PKLITEv114v120
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [2] BA [2] 05 [2] 3B 06 [2] 72 ?? B4 09 BA [2] CD 21 CD 20 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A legacy line-of-business (LOB) application or internal tooling is installed on user workstations or servers using the PKLite installer. The YARA rule likely matches the pklite.exe binary or specific PE section characteristics associated with versions 114 and 120.

  • Filter/Exclusion: Exclude files located in known application installation directories (e.g., C:\Program Files\[AppName]\ or C:\Program Files (x86)\[AppName]\) where the executable name is pklite.exe or pklitev114.exe/pklitev120.exe. Additionally, exclude processes spawned by the specific LOB application’s main executable if the rule triggers on process creation.

• Scenario: IT administrators perform a mass deployment or update of a legacy application via Group Policy Objects (GPO) or Configuration Manager (SCCM/MECM). The PKLite installer runs as a scheduled task or startup script on multiple endpoints simultaneously, triggering the YARA signature on the installer binary or the resulting service executable.

  • Filter/Exclusion: Exclude events where the parent process is wuaex.dll (Windows Update Agent), ccmexec.exe (SCCM Client), or svchost.exe (if running as a service) and the file path contains pklite or matches the specific versioned binary name. Correlate with recent change tickets or deployment logs for the specific application.

• Scenario: A backup or disaster recovery solution (e.g., Veeam, Commvault, or Acronis) creates shadow copies or restores files from a backup repository. If the backup agent processes or restores the PKLite installer binary or the application’s data files that contain the YARA-matching signature, the rule may trigger on the restored file or the backup agent’s temporary working directory.