PKLITEv150Devicedrivercompression

Hunt Hypothesis

This detection identifies potential adversary activity involving the compression of device drivers using the PKLite v1.50 library, a technique often employed to obfuscate malicious payloads or stage components for execution within the kernel space. A proactive hunt is essential in Azure Sentinel to uncover stealthy supply chain compromises or early-stage lateral movement that may evade standard signature-based defenses by leveraging legitimate driver compression mechanisms.

YARA Rule

rule PKLITEv150Devicedrivercompression
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B4 09 BA 14 01 CD 21 B8 00 4C CD 21 F8 9C 50 53 51 52 56 57 55 1E 06 BB }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the PKLITEv150Devicedrivercompression detection rule, including targeted filters and exclusions:

• Scenario: Scheduled Driver Updates via Windows Update or WSUS

  • Context: The Windows Update service (wuauserv) frequently downloads and installs compressed driver packages (.cab or .zip files) containing PKLite-compressed firmware. During the installation phase, the extraction process triggers the YARA rule as it decompresses the driver payload.
  • Filter/Exclusion: Exclude processes where ImageName is usoc_dla.exe, wuauclt.exe, or TiWorker.exe (Windows Update components) and the parent process is svchost.exe. Alternatively, add a filter for file paths containing \Windows\SoftwareDistribution\Content\.

• Scenario: Endpoint Protection Agent Self-Updates

  • Context: Major EDR solutions like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint often package their own kernel-mode driver updates using PKLite compression to minimize network overhead. When the agent performs a background update, it extracts these compressed drivers into the system directory.
  • Filter/Exclusion: Create an exclusion list for known EDR processes (e.g., falcon.sys, s1agent.exe, MsMpEng.exe) and their associated service executables (C:\Program Files\CrowdStrike\... or C:\Windows\System32\).

• Scenario: Admin Deployment of Hardware Drivers via SCCM/Intune

  • Context: System Administrators using Microsoft Endpoint Configuration Manager (SCCM) or Intune often push driver packages to endpoints. These deployments utilize compressed archives that are unpacked by the ccmsetup.exe or `int