PKLITEv1501

Hunt Hypothesis

This rule detects the presence of PKLite, a lightweight SQLite database engine often embedded in Windows applications, which adversaries may leverage to store stolen data or maintain persistence without the overhead of a full database service. Proactively hunting for this artifact in Azure Sentinel allows the SOC to identify potentially compromised endpoints or unusual data staging activities that standard database monitoring might miss due to its minimal footprint.

YARA Rule

rule PKLITEv1501
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 B8 [2] BA [2] 05 [2] 3B 06 [2] 72 ?? B4 ?? BA [2] CD 21 B8 [2] CD 21 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: An administrator manually runs the pklite.exe utility from the Windows Resource Kit or a standalone download to defragment a specific user profile or system drive during a maintenance window.
  • Filter/Exclusion: Exclude processes where the parent process is explorer.exe or cmd.exe/powershell.exe and the command line arguments contain specific flags like /f (defragment) or /v (verbose), provided the execution path is in a known administrative tools directory (e.g., C:\Program Files\Windows Resource Kit\).
• Scenario: A scheduled task named “Disk Maintenance” or “Profile Cleanup” executes pklite.exe to clean up temporary files or defragment the C: drive for all users at 2:00 AM daily.
  • Filter/Exclusion: Exclude executions where the parent process is svchost.exe (specifically the Task Scheduler service) or Taskeng.exe, and the full path of the executable matches a known trusted location such as C:\Windows\System32\ or a dedicated maintenance folder like C:\AdminTools\.
• Scenario: A software deployment tool (e.g., SCCM, Intune, or PDQ Deploy) pushes a script that invokes pklite.exe to optimize disk space on newly imaged workstations before user sign-in.
  • Filter/Exclusion: Exclude processes where the parent process is a known deployment agent such as ccmexec.exe (SCCM), IntuneAgent.exe, or pdqdeploy.exe, and the working directory is within the deployment staging area (e.g., C:\Windows\CCM\ or C:\ProgramData\Intune\).
• Scenario: A third-party disk optimization suite (e.g., IObit Advanced SystemCare, CCleaner