NsPackV2XLiuXingPing

Hunt Hypothesis

This detection rule identifies potential adversary activity involving the execution of the “NsPack” utility, which may indicate reconnaissance or the deployment of a custom payload within the Azure environment. A proactive hunt is recommended to validate these events and distinguish legitimate administrative usage from suspicious behavior that could signal early-stage lateral movement or data exfiltration attempts.

YARA Rule

rule NsPackV2XLiuXingPing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 6E 73 70 61 63 6B 24 40 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Based on the rule title NsPackV2XLiuXingPing and its focus on “NsPack” (likely referring to network scanning or packet analysis activities), here are 5 specific false positive scenarios common in enterprise environments, along with targeted exclusion strategies:

• Scenario: Scheduled Vulnerability Scanning by Tenable Nessus

  • Context: The nightly vulnerability scan job initiated by the Tenable Nessus server performs deep packet inspection and connectivity checks against all endpoints. This generates a high volume of connection attempts that mimic external reconnaissance or suspicious probing, triggering the rule.
  • Suggested Filter/Exclusion: Create an exclusion for the specific IP address range of the Nessus Management Server (e.g., 10.20.5.10) and whitelist the executable path C:\Program Files\Tenable\Nessus\nessusd.exe to ignore its scanning traffic during business hours or specific maintenance windows.

• Scenario: Microsoft Defender for Endpoint Real-Time Protection

  • Context: The built-in “Network Inspection” feature of Microsoft Defender continuously monitors network packets and performs background telemetry uploads to the cloud. These automated health checks often involve MsMpEng.exe initiating multiple outbound connections that resemble the rule’s detection logic for unusual packet structures.
  • Suggested Filter/Exclusion: Configure a filter in the SIEM or EDR console to exclude traffic originating from the process name MsMpEng.exe and the service account NT SERVICE\MsMpSvc, specifically targeting ports 443 and 5061 used for telemetry.

• Scenario: Automated Backup Jobs via Veeam Backup & Replication

  • Context: During peak backup windows, the Veeam Backup Server initiates network discovery to verify storage connectivity and validate repository health. This process involves sending specific packet probes that can be misidentified as