nSpackV2xLiuXingPing

Hunt Hypothesis

This detection identifies potential Liu Xing Ping activity by leveraging a specific YARA signature to flag known malicious artifacts within Azure Sentinel logs. Proactive hunting for this behavior is essential to uncover early-stage threats that may evade standard heuristic controls, allowing the SOC team to investigate and contain low-severity indicators before they escalate into broader incidents.

YARA Rule

rule nSpackV2xLiuXingPing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the nSpackV2xLiuXingPing YARA rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Endpoint Protection Scans

  • Context: The rule triggers when Microsoft Defender Antivirus or CrowdStrike Falcon performs its scheduled daily heuristic scan. These engines often unpack archives (.zip, .7z) containing application updates in the C:\ProgramData directory, which matches the byte patterns of the Liu Xing Ping signature.
  • Suggested Filter: Exclude processes where the parent process is MsMpEng.exe or FalconSensorService.exe and the file path contains \ProgramData\Microsoft\Windows Defender\.

• Scenario: IT Asset Management Inventory Jobs

  • Context: A nightly scheduled task running PDQ Deploy or SCCM (System Center Configuration Manager) agents pushes software inventory updates. The agent extracts a compressed deployment package containing the nSpack signature before installation, causing the YARA rule to flag the extraction process as suspicious activity.
  • Suggested Filter: Create an exclusion for files located in C:\Windows\CCMCache\ or C:\Program Files (x86)\PDQ\Deploy\ where the file extension is .tmp, .zip, or .msp.

• Scenario: Developer Build and CI/CD Pipelines

  • Context: On build servers running Jenkins or GitLab Runner, the pipeline executes a step to unpack source code repositories. The nSpackV2xLiuXingPing signature is frequently embedded within third-party NuGet packages or Docker image layers that are extracted during the “Build” phase, triggering alerts on build agents rather than user endpoints.