PKLITEv200c

Hunt Hypothesis

This rule detects the presence of the PKLite v200c library, a lightweight SQLite implementation often embedded in portable or obfuscated malware to facilitate local data storage and persistence. Proactively hunting for this artifact helps identify compromised hosts where adversaries may be using non-standard database engines to hide configuration files, logs, or stolen data from standard forensic tools.

YARA Rule

rule PKLITEv200c
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 B8 [2] BA [2] 3B C4 73 ?? 8B C4 2D [2] 25 [2] 8B F8 B9 [2] BE [2] FC }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: An IT administrator manually runs the pkLite executable from a shared network drive or local temp folder to compress a large legacy application database (e.g., C:\Temp\pkLite\pkLite.exe) before a scheduled maintenance window.
  • Filter/Exclusion: Exclude the rule if the process path matches C:\Temp\pkLite\ or \\FileServer\IT\Tools\pkLite\ and the parent process is explorer.exe or cmd.exe initiated by an admin account.
• Scenario: A CI/CD pipeline or automated backup script uses pkLite as part of a pre-backup compression step for SQL Server or Oracle databases, launching it via a scheduled task or PowerShell script.
  • Filter/Exclusion: Exclude if the parent process is powershell.exe or cmd.exe and the command line arguments contain specific database file extensions (.mdf, .ldf, .dbf) or if the process is spawned by a known service account (e.g., svc_backup).
• Scenario: A developer or QA engineer uses pkLite locally to optimize a test database during application development, running it from a user profile directory like C:\Users\<User>\AppData\Local\Temp\.
  • Filter/Exclusion: Exclude if the process path resides within C:\Users\<User>\AppData\Local\Temp\ or C:\Users\<User>\Desktop\ and the user is part of the DevTeam or QATeam security group.
• Scenario: A legacy line-of-business application bundles pkLite in its installation directory (e.g., C:\Program Files\LegacyApp\bin\pkLite.exe) and invokes it automatically during startup or data sync processes.
  • **Filter/