NorthStarPEShrinker13Liuxingping

Hunt Hypothesis

This hunt hypothesis targets adversaries utilizing the specific “NorthStarPEShrinker13Liuxingping” signature to identify early-stage file-based threats that may evade standard heuristic detection. Proactive hunting in Azure Sentinel is essential to uncover these low-severity indicators before they escalate, ensuring comprehensive visibility into potential lateral movement or initial access attempts within the environment.

YARA Rule

rule NorthStarPEShrinker13Liuxingping
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the NorthStarPEShrinker13Liuxingping detection rule, including suggested filters and exclusions:

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Enterprise endpoints running Microsoft Defender for Endpoint or Symantec Endpoint Protection often trigger this YARA signature during nightly definition update cycles. The Liuxingping logic may flag the temporary extraction of compressed signature databases by the antivirus engine as a suspicious process behavior, mistaking it for a shimming attack.
  • Filter/Exclusion: Create an exclusion based on the process image path and parent process. Exclude any detection where the parent process is MsMpEng.exe (Microsoft) or Symantec Endpoint Protection Client (Srtsc.exe) and the file extension is .cab or .zip.

• Scenario: Automated Patch Deployment via SCCM

  • Context: During enterprise-wide patching windows, System Center Configuration Manager (SCCM) or Microsoft Intune deploys updates using PowerShell scripts that invoke temporary executables. The rule may trigger when these deployment agents extract and execute the NorthStarPEShrinker utility to compress logs or cache files before applying patches.
  • Filter/Exclusion: Implement a time-based exclusion for the “Patch Tuesday” window (e.g., Tuesdays 02:00–06:00 UTC). Additionally, exclude process names matching CcmExec.exe and IntuneManagementExtension.exe when they spawn child processes with file sizes under 5MB.

• Scenario: Legacy Backup Agent Operations

  • Context: Organizations utilizing legacy backup solutions like Veeam Backup & Replication or Commvault often run agents that perform incremental backups by shimming file system changes. The YARA