NsPacKNetLiuXingPing

Hunt Hypothesis

This hunt hypothesis targets the specific network activity patterns of the NsPacKNetLiuXingPing malware to identify early-stage reconnaissance or lateral movement behaviors that may evade standard signature-based detection. Proactively hunting for this indicator in Azure Sentinel is essential to validate its presence within the environment and assess potential low-severity risks before they escalate into more significant incidents.

YARA Rule

rule NsPacKNetLiuXingPing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 BB 01 47 65 74 53 79 73 74 65 6D 49 6E 66 6F 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 5E 00 5F 43 6F 72 [3] 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the NsPacKNetLiuXingPing detection rule, including suggested filters and exclusions:

• Scenario: Automated network health checks performed by SolarWinds NPM (Network Performance Monitor) or PRTG.

  • Context: These tools frequently execute high-volume ICMP ping sweeps across the enterprise subnet to monitor latency and uptime. The YARA rule may flag the continuous stream of ping.exe processes initiating from the monitoring server as suspicious network activity if they deviate slightly from a baseline signature.
  • Suggested Filter/Exclusion: Create an exclusion for the specific monitoring service account (e.g., DOMAIN\svc_solarwinds) and restrict the rule to trigger only when the source IP is not within the designated “Monitoring Subnet” (e.g., 10.20.50.0/24).

• Scenario: Scheduled maintenance jobs running Microsoft SCCM (Configuration Manager) or Intune compliance scans.

  • Context: During nightly maintenance windows, these agents execute connectivity tests to verify client reachability before pushing updates. The ping utility is often invoked by the background service (ccmexec.exe) to validate network paths, which can trigger the rule due to the specific packet structure or process tree depth.
  • Suggested Filter/Exclusion: Add a time-based exclusion window (e.g., 01:00 – 05:00 local time) for processes spawned by ccmexec.exe and IntuneManagementExtension. Additionally, exclude traffic originating from the SCCM Site Server IP range.

• Scenario: IT Admins performing manual troubleshooting using PowerShell scripts or Wireshark analysis sessions.

  • Context: System administrators often run custom PowerShell scripts (`Get-Net