PKLITEv200b

Hunt Hypothesis

This YARA rule targets the PKLite v200b library, a lightweight SQLite implementation often embedded in portable or obfuscated malware to provide local data storage without requiring a full database engine. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify potentially suspicious executables or scripts that leverage this specific library for persistence or data staging, particularly in environments where standard SQLite usage is not expected.

YARA Rule

rule PKLITEv200b
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 B8 [2] BA [2] 05 [2] 3B 06 02 00 72 ?? B4 09 BA [2] CD 21 B8 01 4C CD 21 [30] 59 2D [2] 8E D0 51 2D [2] 8E C0 50 B9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: An IT administrator runs the pkLite command-line utility to optimize and defragment the local SQL Server database files (.mdf/.ldf) on a domain controller or application server during a scheduled maintenance window.
  • Filter/Exclusion: Exclude processes where the parent process is cmd.exe or powershell.exe and the command line contains arguments like -optimize or -defrag, specifically targeting file paths ending in .mdf or .ldf.
• Scenario: A legacy application installer or configuration script executes pkLite.exe as part of a post-install task to compress the application’s embedded SQLite database to reduce disk footprint.
  • Filter/Exclusion: Exclude executions where the working directory matches the application’s installation path (e.g., C:\Program Files\LegacyApp\) and the target file is named app.db or config.sqlite.
• Scenario: A security team performs a manual database integrity check on a test database file using pkLite to verify that the file is not corrupted before migrating it to a new server.
  • Filter/Exclusion: Exclude executions where the user account belongs to the DBA_Group or Security_Team AD group, and the target file resides in a dedicated C:\Temp\DB_Checks\ directory.
• Scenario: A developer on a build server uses pkLite in a CI/CD pipeline step to optimize the SQLite database used for local testing artifacts before archiving the build output.
  • Filter/Exclusion: Exclude executions on hosts tagged as BuildServer or CI-CD where the parent process is jenkins.exe, azureagent.exe, or git.exe, and the target file path contains /artifacts/ or /builds/.