NsPack29NorthStar

Hunt Hypothesis

This detection identifies the presence of the NorthStar malware family within Azure Sentinel by leveraging a specific YARA signature to capture known malicious artifacts. Proactive hunting for this indicator is essential to uncover early-stage infections that may exhibit low severity initially but could evolve into significant threats if left unaddressed in the cloud environment.

YARA Rule

rule NsPack29NorthStar
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 [2] FF FF 8A 06 3C 00 74 12 8B F5 8D B5 [2] FF FF 8A 06 3C 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 [2] FF FF 89 95 [2] FF FF 01 95 [2] FF FF 8D B5 [2] FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 [2] FF FF 85 C0 0F 84 6A 03 00 00 89 85 [2] FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD [2] FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the NsPack29NorthStar detection rule, including recommended filters and exclusions:

• Scenario: Microsoft Defender Antivirus Engine Updates

  • Context: The MsMpEng.exe process frequently loads the NorthStar signature pack during scheduled definition updates (typically occurring at 03:00 AM or upon user login). This triggers the YARA rule as it scans the new package structure.
  • Filter/Exclusion: Exclude processes where the parent image is C:\Program Files\Microsoft Defender Antivirus\MsMpEng.exe and the file path matches *\.mpack. Alternatively, add a filter to ignore events occurring during the defined maintenance window (e.g., 02:00–04:00 daily).

• Scenario: SCCM/Intune Application Deployment

  • Context: During enterprise-wide software deployments using Microsoft Endpoint Configuration Manager (SCCM) or Intune, the ccmexec.exe service installs application packages that contain NorthStar-structured components. The rule fires when these packages are unpacked in the temp directory (C:\Windows\CCMCache).
  • Filter/Exclusion: Create an exclusion for file paths containing \CCMCache\* and processes initiated by ccmexec.exe. Additionally, filter out events where the user context is a service account (e.g., NT SERVICE\CCM) rather than an interactive user.

• Scenario: Backup Agent Scanning Operations

  • Context: Enterprise backup solutions like Veeam or Rubrik often utilize NorthStar packaging for their metadata and agent components. When the backup job runs, the VeeamAgent.exe (or similar) reads these packages into memory, triggering a match on the NsPack signature.
  • **Filter/Ex