Anti007V26LiuXingPing

Hunt Hypothesis

This rule targets the LiuXingPing malware variant, a known threat actor often associated with initial access or persistence mechanisms in enterprise environments. Proactively hunting for this signature allows the SOC to identify compromised endpoints before the adversary establishes lateral movement or exfiltrates data within the Azure Sentinel environment.

YARA Rule

rule Anti007V26LiuXingPing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 57 72 69 74 65 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of the liuxingping utility (or a similarly named custom internal script) by the IT Operations team during a scheduled Windows Patch Tuesday maintenance window. The tool is used to verify network interface configurations or reset specific service states on domain controllers.
  • Filter/Exclusion: Exclude processes where the parent process is Task Scheduler (taskschd.exe) or PowerShell.exe initiated by a service account, and the file path resides in a trusted administrative directory (e.g., C:\AdminTools\NetUtils\).
• Scenario: A DevOps engineer runs a custom-built binary named liuxingping.exe (derived from the developer’s name) as part of a CI/CD pipeline deployment job on a build agent. The binary is used to compress and archive log files before uploading them to the artifact repository.
  • Filter/Exclusion: Exclude executions where the working directory is under the build agent’s workspace (e.g., C:\jenkins\workspace\ or C:\azure-pipelines\) and the parent process is a known CI/CD agent (e.g., jenkins.exe, agent.exe, or vstsagent.exe).
• Scenario: A Security Engineer performs a threat hunting exercise or red team simulation where they deploy a benign canary token or a specific utility named liuxingping to test detection coverage on a non-production test server.
  • Filter/Exclusion: Exclude hosts tagged in the CMDB or asset management system as Environment: Test or Role: RedTeam, or exclude if the process is launched by a user account with the ThreatHunt group membership.
• Scenario: A legacy application (e.g., a specific Chinese enterprise resource planning module) bundles