NorthStarPEShrinkerv13byLiuxingping

Hunt Hypothesis

This detection identifies the presence of the NorthStar PE Shrinker v13 utility, which adversaries often leverage to obfuscate malicious payloads by compressing and encrypting executable files before deployment. Proactively hunting for this tool in Azure Sentinel is essential because its legitimate appearance can mask the initial stages of a supply chain attack or fileless malware campaign that relies on runtime decompression to evade traditional signature-based defenses.

YARA Rule

rule NorthStarPEShrinkerv13byLiuxingping
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 73 ?? FF FF 8B 06 83 F8 00 74 11 8D B5 7F ?? FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 4F ?? FF FF 2B D0 89 95 4F ?? FF FF 01 95 67 ?? FF FF 8D B5 83 ?? FF FF 01 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the NorthStarPEShrinkerv13byLiuxingping detection rule, tailored for a legitimate enterprise environment:

• Scenario: Automated Deployment of Microsoft Office Updates via Configuration Manager (SCCM/MECM)

  • Context: The System Center Configuration Manager client service (ccmexec.exe) or the Office Click-to-Run service (OfficeClickToRun.exe) triggers the YARA rule while executing a scheduled shrinker utility to optimize local update caches during off-hours. This often involves compressing temporary download artifacts that match the heuristic signature of the NorthStar shrinker.
  • Suggested Filter: Exclude processes where ImageName equals ccmexec.exe, OfficeClickToRun.exe, or UpdateService.exe running under the context of the SYSTEM or a dedicated deployment account (e.g., DOMAIN\SCCM-Deploy).

• Scenario: Enterprise Antivirus Cloud Optimization Routine

  • Context: Major security suites like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Symantec Endpoint Protection run nightly “clean-up” jobs that utilize internal compression modules to archive old threat logs and quarantine data. These internal utilities often mimic the binary structure of the NorthStar shrinker tool detected by the rule.
  • Suggested Filter: Create an exclusion based on ParentImageName containing keywords like FalconSensor.exe, MsMpEng.exe, or Rtvscan64.exe, specifically when the child process name contains “Shrink”, “Compact”, or “Optimize”.

• Scenario: Database Backup and Archiving via Veeam or Commvault

  • Context: During scheduled backup windows, enterprise data protection tools (e.g., VeeamBackupService.exe or CommServe.exe) invoke a compression engine to shrink large transaction logs before arch