NsPackv23NorthStar

Hunt Hypothesis

This detection identifies potential North Star malware activity by matching file signatures against the NsPackv23NorthStar YARA rule within Azure Sentinel. Proactive hunting for this behavior is essential to uncover early-stage infections that may evade standard signature-based defenses and prevent lateral movement before escalation.

YARA Rule

rule NsPackv23NorthStar
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 [2] FF FF 8B 06 83 F8 00 74 11 8D B5 [2] FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 [2] FF FF 2B D0 89 95 [2] FF FF 01 95 [2] FF FF 8D B5 [2] FF FF 01 16 8B 36 8B FD }
	$a1 = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 [2] FF FF 8B 06 83 F8 00 74 11 8D B5 [2] FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 [2] FF FF 2B D0 89 95 [2] FF FF 01 95 [2] FF FF 8D B5 [2] FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 [2] FF FF 85 C0 0F 84 56 03 00 00 89 85 [2] FF FF E8 00 00 00 00 5B B9 54 03 00 00 03 D9 50 53 E8 9D 02 00 00 61 }

condition:
		$a0 or $a1
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the NsPackv23NorthStar detection rule, including suggested filters and exclusions:

• Scenario: Microsoft Endpoint Configuration Manager (SCCM) Application Deployment

  • Context: The SCCM client service (ccmexec.exe) frequently executes a packed installer payload during scheduled application deployments. The YARA rule detects the specific packing signature within the temporary deployment package as a potential NorthStar variant, mistaking the legitimate distribution mechanism for an unknown executable.
  • Filter/Exclusion: Exclude processes where the parent process is ccmexec.exe and the file path contains \Microsoft\CCM\. Alternatively, add a filter to ignore files with a digital signature from “Microsoft Corporation” that are located within the SCCM installation directory (C:\Program Files (x86)\Microsoft Configuration Manager).

• Scenario: CrowdStrike Falcon Sensor Real-Time Scan

  • Context: The CrowdStrike sensor (csfalcon.exe) performs on-access scanning of newly downloaded archives. When unpacking a compressed archive containing the NorthStar signature, the rule triggers because the temporary extraction process mimics the behavior of the target malware’s packing routine.
  • Filter/Exclusion: Create an exclusion for any file path starting with C:\ProgramData\CrowdStrike\ or where the parent process is csfalcon.exe. Additionally, exclude files that are less than 30 seconds old and located in temporary directories (%TEMP%) to avoid catching transient scan artifacts.

• Scenario: Ansible Automation Tower Job Execution

  • Context: During nightly infrastructure updates, Ansible Tower executes a playbook that deploys a custom utility tool wrapped in the same packing format detected by NsPackv23NorthStar. The rule flags this legitimate automation artifact as suspicious because it lacks a standard commercial signature and matches the