nPackv11250BetaNEOx

Hunt Hypothesis

This YARA rule targets the nPack v11.25.0 Beta NEOx variant, a known component of the nPack malware family often used for initial access or payload delivery in enterprise environments. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify compromised hosts or staging areas before the malware can establish persistence or execute further post-exploitation actions.

YARA Rule

rule nPackv11250BetaNEOx
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 3D 04 [3] 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E [3] 2B 05 08 [3] A3 00 [3] E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 [3] C7 05 04 [3] 01 00 00 00 01 05 00 [3] FF 35 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of the nPack utility by a DevOps engineer or CI/CD pipeline agent to package and distribute internal software artifacts (e.g., .nupkg or custom binary bundles) during a nightly build or deployment job.

  • Filter/Exclusion: Exclude processes where the parent process is a known build agent (e.g., agent.exe for Azure DevOps, jenkins-agent.jar, or dockerd) or where the command line contains arguments typical of packaging operations (e.g., /pack, /create, /build).

• Scenario: A system administrator manually runs nPack from an elevated command prompt to compress large log files or configuration backups before transferring them to a backup server via robocopy or scp.

  • Filter/Exclusion: Exclude if the process is launched by cmd.exe or powershell.exe and the working directory is a standard admin path (e.g., C:\Admin\Tools\ or C:\Users\<Admin>\Downloads\), or if the parent process is explorer.exe and the user is in the local administrators group.

• Scenario: A scheduled task (e.g., DailyLogRotation) executes nPack to archive and compress daily application logs in a specific directory (e.g., D:\AppLogs\) as part of routine maintenance.

  • Filter/Exclusion: Exclude if the process is initiated by schtasks.exe or Task Scheduler and the target path matches a known log archive directory pattern (e.g., *Logs*, *Archive*, *Backup*).

• Scenario: A third-party application installer or updater (e.g., for a niche enterprise tool like “InternalCRM”) uses nPack as a helper binary to unpack or pack configuration files during the installation