NsPackV14LiuXingPing

Hunt Hypothesis

This detection identifies the presence of the Liu Xing Ping malware family by scanning file artifacts against a specific YARA signature to uncover potential initial access or persistence mechanisms. A proactive hunt is essential in Azure Sentinel to validate false positives and assess the broader impact of this low-severity indicator, ensuring that early-stage threats are not overlooked before they escalate into more critical incidents.

YARA Rule

rule NsPackV14LiuXingPing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 B1 85 40 00 2D AA 85 40 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the NsPackV14LiuXingPing detection rule, including suggested filters and exclusions:

• Scenario: Legitimate execution of the Liu Xing Ping (Star Rating) performance monitoring agent during its scheduled nightly health check.

  • Context: The enterprise deploys a custom or third-party performance tool named “Liu Xing Ping” that runs a nightly scan to rate system stability, triggering the YARA signature due to matching file hashes or string patterns within the NsPack directory.
  • Filter/Exclusion: Add an exclusion for processes running under the specific user account svc-lxping-monitor and restrict the path to C:\Program Files\LiuXingPing\bin\.

• Scenario: Deployment of a new software package via Microsoft Endpoint Configuration Manager (SCCM) or Intune.

  • Context: During a scheduled patch Tuesday deployment, the SCCM client extracts the NsPackV14 installer to a temporary staging folder (C:\Windows\CCMCache) before installation. The YARA rule scans this unpacked archive and flags it as suspicious activity.
  • Filter/Exclusion: Exclude file paths containing \CCMCache\ and whitelist the executable ccmsetup.exe when it spawns child processes in the temporary extraction directories.

• Scenario: Execution of a PowerShell administrative script by the System Administrator team for routine database maintenance.

  • Context: An admin runs a scheduled PowerShell job (Start-Job) that utilizes a custom module named NsPackV14 to analyze network latency and generate reports, which matches the detection logic’s string signatures.
  • Filter/Exclusion: Filter out events where the parent process is powershell.exe or pwsh.exe running