This YARA rule targets the Pksmart10b signature, which is commonly associated with specific malware families or exploit kits that may be used for initial access or payload delivery. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify compromised endpoints or suspicious processes before the adversary establishes a foothold or executes further post-compromise actions.
rule Pksmart10b
{
meta:
author="malware-lu"
strings:
$a0 = { BA [2] 8C C8 8B C8 03 C2 81 [3] 51 B9 [2] 51 1E 8C D3 }
condition:
$a0 at pe.entry_point
}This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Scenario: A legacy Java-based application server (e.g., Tomcat or JBoss) is deployed with a custom pksmart or similar PKCS#12 smart card authentication library for internal service-to-service communication. The YARA rule may match the specific bytecode or string patterns within the JAR/WAR file or the running process memory.
C:\Program Files\Apache Tomcat\bin\catalina.bat or java.exe and the command line contains org.apache.catalina.startup.Bootstrap. Additionally, exclude file paths ending in .jar or .war within the application server’s lib or webapps directories.Scenario: An enterprise backup solution (e.g., Veeam, Commvault, or Veritas) uses a proprietary smart card or token-based authentication module for secure credential storage during backup jobs. The pksmart library is loaded as a DLL during the backup agent’s execution.
vssadmin.exe, commvault\cv.exe, or veritas\vtss.exe) and the loaded module path contains pksmart.dll or pksmart10b.dll. You can also exclude based on the service name if the backup agent runs as a Windows service.Scenario: A developer or IT admin is testing a new PKCS#12 smart card reader driver or middleware (e.g., from a vendor like Idem, Utimaco, or Entrust) on a jump host or build server. The YARA rule triggers on the test binary or the associated DLL during manual testing or CI/CD pipeline steps.