NsPackV11LiuXingPing

Hunt Hypothesis

This detection identifies the presence of the Liu Xing Ping malware family on endpoints by leveraging a specific YARA signature to catch known malicious artifacts. Proactive hunting for this indicator in Azure Sentinel is essential to uncover potential early-stage infections that may evade standard signature-based defenses, allowing the SOC team to assess lateral movement risks before an incident escalates.

YARA Rule

rule NsPackV11LiuXingPing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 57 84 40 00 2D 50 84 40 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the NsPackV11LiuXingPing detection rule, along with recommended filters and exclusions tailored for an enterprise environment:

• Scenario: Microsoft Office Click-to-Run Updates

  • Context: The OfficeClickToRun.exe process frequently spawns child processes that utilize the NsPack packing structure during routine background updates or feature installations. This often triggers the YARA rule when the update service modifies registry keys or writes to the AppData directory.
  • Filter/Exclusion: Exclude processes where the parent image path matches C:\Program Files\Microsoft Office Root\Office16\ and the process name is OfficeClickToRun.exe. Additionally, filter out events where the file hash matches known Microsoft-signed update binaries.

• Scenario: CrowdStrike Falcon Sensor Telemetry Collection

  • Context: The CrowdStrike Falcon sensor (specifically the csfalcon.exe or CsaAgent.exe components) utilizes NsPack for its internal telemetry modules and policy distribution agents. When these agents perform scheduled health checks or push new detection policies, they generate artifacts that match the LiuXingPing signature logic.
  • Filter/Exclusion: Create a whitelist exclusion for any process tree rooted at C:\Program Files\CrowdStrike\ where the file extension is .dll or .exe. Ensure the exclusion applies specifically to the “Falcon Sensor” service account context.

• Scenario: Scheduled Antivirus Scan (Symantec Endpoint Protection)

  • Context: During peak business hours, Symantec Endpoint Protection runs scheduled full scans. The Rtvscan64.exe process often unpacks and analyzes compressed archives containing NsPack structures, causing the YARA rule to flag these legitimate scanning activities as potential LiuXingPing behavior.