Rule to detect the presence of SQLite data in raw image

Hunt Hypothesis

This hunt targets adversaries who embed or exfiltrate structured data via SQLite databases within raw disk images to evade standard file-based detection mechanisms. Proactively hunting for this signature in Azure Sentinel is critical because it reveals hidden data staging activities that often precede lateral movement or data exfiltration, even when traditional alerting thresholds are not triggered.

YARA Rule

rule with_sqlite : sqlite
{
	meta:
		author = "Julian J. Gonzalez <[email protected]>"
		reference = "http://www.st2labs.com"
		description = "Rule to detect the presence of SQLite data in raw image"
	strings:
		$hex_string = {53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00}
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• http://www.st2labs.com
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Rule to detect the presence of SQLite data in raw image” detection logic, including suggested filters and exclusions:

• Scenario: Automated OS Patching via WSUS or SCCM

  • Context: During scheduled maintenance windows, tools like Microsoft Endpoint Configuration Manager (SCCM) or WSUS download patch metadata and local cache manifests into temporary SQLite databases within the raw image of the system drive. These files often appear as new artifacts before being committed to the OS registry.
  • Filter/Exclusion: Exclude file paths matching C:\Windows\SoftwareDistribution\* and C:\Program Files (x86)\Microsoft Configuration Manager\*. Additionally, suppress alerts where the process name is ccmexec.exe or wuauserv.exe running during defined maintenance hours (e.g., 02:00–04:00).

• Scenario: Endpoint Protection Real-Time Scanning

  • Context: Security agents such as CrowdStrike Falcon, SentinelOne, or Carbon Black frequently utilize local SQLite databases to store real-time telemetry, event logs, and policy definitions directly on the disk. When these agents perform a background scan of the raw image (e.g., checking for file integrity), they may generate new SQLite headers that trigger the rule.
  • Filter/Exclusion: Create an exclusion list for known security agent processes (csfalcon.exe, s1agent.exe, cb.exe) and specific directories like C:\ProgramData\CrowdStrike\ or C:\SentinelOne\. Filter out events where the file extension is .db or .sqlite3 located within these protected vendor folders.

• Scenario: Local Deployment of Development Tools (Docker/Dev Containers)

  • Context: In