NsPack 30 North Star additional

Hunt Hypothesis

This hypothesis targets the presence of NsPack 30 North Star additional YARA signatures, which may indicate the use of specific packing or obfuscation techniques to hide malicious payloads from static analysis. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify stealthy or low-severity threats that evade standard detection rules and potentially uncover early-stage intrusion attempts.

YARA Rule

rule NsPack_30_North_Star_additional: PEiD
{
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legitimate Deployment of NorthStar Analytics via SCCM/Intune: The NsPack_30_North_Star_additional YARA rule likely targets specific binary signatures or memory patterns associated with the NorthStar analytics suite. In a large enterprise, this software is often deployed silently via System Center Configuration Manager (SCCM) or Microsoft Intune to all endpoints. The installation process may temporarily load components into memory or create specific file artifacts that match the rule’s signature.

  • Filter/Exclusion: Exclude processes where the parent process is ccmsetup.exe (SCCM) or IntuneAgent.exe (Intune), or filter by file path if the executable resides in standard installation directories like C:\Program Files\NorthStar\ or C:\Program Files (x86)\NorthStar\.

• Scheduled Data Ingestion Jobs by NorthStar Agent: NorthStar often includes a background agent that runs scheduled tasks to ingest logs or telemetry data. These tasks may be triggered by Task Scheduler (taskschd.msc) or cron (on Linux) and execute a helper binary that matches the YARA signature. This is a normal operational task, not an anomaly.

  • Filter/Exclusion: Exclude alerts where the process name is known NorthStar agent binaries (e.g., nsagent.exe, northstar_service.exe) and the parent process is svchost.exe (if running as a service) or TaskScheduler.exe. Additionally, filter by specific scheduled task names if they are standardized, such as NorthStar_DailySync or NsPack_Telemetry.

• Development/Testing Environments with Debuggers: In development or QA environments, engineers may run NorthStar applications under debuggers (like Visual Studio or WinDbg) or use profiling tools. These tools can alter memory layouts or inject code, causing the