NsPack30NorthStar

Hunt Hypothesis

This detection identifies potential malicious activity associated with the NsPack30NorthStar signature, which may indicate the presence of a specific software packer or obfuscation technique often utilized by threat actors to conceal payload execution. A proactive hunt is recommended within Azure Sentinel to validate whether these observed instances represent legitimate administrative tooling or an early-stage adversary attempt to evade standard heuristic analysis through code packing mechanisms.

YARA Rule

rule NsPack30NorthStar
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 [2] FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 [2] FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 [2] FF FF 89 95 [2] FF FF 01 95 [2] FF FF 8D B5 [2] FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 [2] FF FF 85 C0 0F 84 6A 03 00 00 89 85 [2] FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD [2] FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the NsPack30NorthStar detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Antivirus Definition Updates via Windows Update Agent

  • Context: The WindowsUpdate service or third-party agents like Microsoft Defender for Endpoint frequently download and unpack definition updates (often in .cab or .msi formats) that match the NsPack30NorthStar signature structure. These updates occur on a strict schedule (e.g., daily at 2:00 AM) and involve legitimate file extraction processes.
  • Filter/Exclusion: Exclude process paths containing C:\Program Files\Windows Defender\MpCmdRun.exe or C:\Windows\System32\usoclient.exe. Additionally, filter out alerts where the parent process is svchost.exe running under the LocalSystem account during the defined maintenance window (01:00–04:00).

• Scenario: Deployment of Enterprise Software via Microsoft Endpoint Configuration Manager (SCCM)

  • Context: During mass software deployments, SCCM utilizes the Task Sequence Engine (TSEngine.exe) to unpack application packages. Many enterprise applications use NSIS-based installers that trigger this rule when extracting payload components during the “Install” phase of a deployment job.
  • Filter/Exclusion: Create an exclusion based on the parent process CcmExec.exe and TSEngine.exe. Furthermore, filter alerts where the file extension is .msi, .exe, or .cab located within the SCCM distribution point directory (e.g., D:\SMSData\Inbox).

• Scenario: Automated Backup Operations by Veeam Backup & Replication

  • Context: The Veeam Transport Service