This rule detects the presence of the PKLite database engine, a lightweight SQLite variant often embedded in legacy applications or used by adversaries to store data locally without a full database server. Proactively hunting for this component helps the SOC identify potential data staging activities or outdated software dependencies that could be leveraged for persistence or information gathering within the Azure environment.
rule PKLITEv120
{
meta:
author="malware-lu"
strings:
$a0 = { B8 [2] BA [2] 05 [2] 3B 06 [2] 72 ?? B4 09 BA [2] CD 21 B4 4C CD 21 }
condition:
$a0 at pe.entry_point
}This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Scenario: An IT administrator manually runs the pklite.exe utility from a shared administrative share (e.g., \\fileserver\tools\) to compact a legacy Access database file (.mdb or .accdb) that has become fragmented due to heavy transactional writes in a small departmental application.
cmd.exe, powershell.exe, or explorer.exe) and the image path resides in a designated administrative tools directory (e.g., C:\AdminTools\, \\fileserver\tools\, or C:\ProgramData\CorpTools\).Scenario: A scheduled maintenance job (Task Scheduler) runs a custom batch script that invokes pklite.exe to optimize large Access databases used by internal reporting tools (e.g., HR_Reports.mdb) during off-peak hours (e.g., 2:00 AM Sunday).
svchost.exe (specifically the Task Scheduler service) and the command line arguments contain the target database file extension (.mdb or .accdb) and the execution time falls within the defined maintenance window.Scenario: A developer or QA engineer uses a portable version of pklite.exe stored in their user profile (C:\Users\<user>\AppData\Local\Temp\ or C:\Users\<user>\Downloads\) to test database integrity after applying a patch to a custom Access-based inventory management system.
DevTeam, `