NsPack34NorthStar

Hunt Hypothesis

This rule identifies the presence of the NsPack34NorthStar artifact, which may indicate a specific malware family or tooling component deployed on endpoints. Proactively hunting for this signature allows the SOC team to detect low-severity threats that might otherwise evade traditional behavioral detections, ensuring early containment of known malicious payloads within the Azure Sentinel environment.

YARA Rule

rule NsPack34NorthStar
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 [2] FF FF 80 38 01 0F 84 42 02 00 00 C6 00 01 8B D5 2B 95 [2] FF FF 89 95 [2] FF FF 01 95 [2] FF FF 8D B5 [2] FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 [2] FF FF 85 C0 0F 84 6A 03 00 00 89 85 [2] FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD [2] FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 [2] FF FF FF B5 [2] FF FF 8B D6 8B CF 8B 85 [2] FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A DevOps engineer runs a custom PowerShell script to package application binaries into a .nupkg or similar archive format, where the script explicitly writes a header string or metadata tag containing “NorthStar” (e.g., NorthStar_Build_v2.1) to the file header for internal tracking.

  • Filter/Exclusion: Exclude files located in specific build artifact directories (e.g., C:\Builds\, D:\Artifacts\) or exclude files with extensions like .nupkg, .zip, or .tar.gz if the rule is designed to catch executable payloads rather than archives.

• Scenario: An IT administrator deploys a corporate security agent or configuration tool named “NorthStar Security Suite” (a hypothetical internal product name) that creates a temporary working file or log file with the name NorthStar_Log.tmp or NorthStar_Config.dat in the %TEMP% or %APPDATA% directories during routine updates.

  • Filter/Exclusion: Exclude paths under %APPDATA% or %TEMP% for known service accounts (e.g., svc_deploy, admin_it) or exclude files matching specific naming patterns like NorthStar_* if the rule is overly broad on string matching.

• Scenario: A data scientist uses a Python script to process a dataset where a column header or metadata field is literally named “NorthStar” (e.g., a star catalog dataset), and the script writes intermediate CSV or JSON files containing this string to a network share (\\fileserver\projects\astronomy\) during batch processing.

  • Filter/Exclusion: Exclude files with data-oriented extensions (.csv, .json, .parquet, .xml) when located in network share paths or user-specific project directories (e.g., C:\Users\[User]\Projects\).