NsPacKV30LiuXingPing

Hunt Hypothesis

This detection identifies potential Liu Xing Ping activity by leveraging a specific YARA signature to match known file artifacts associated with this threat actor within the Azure Sentinel environment. Proactive hunting for this behavior is essential to uncover early-stage indicators of compromise that may not trigger high-severity alerts, allowing the SOC team to investigate and contain low-fidelity threats before they escalate into broader incidents.

YARA Rule

rule NsPacKV30LiuXingPing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 [4] 66 8B 06 66 83 F8 00 74 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the NsPacKV30LiuXingPing detection rule, tailored for a legitimate enterprise environment:

• Scenario: Automated Endpoint Protection Scans

  • Context: The YARA signature matches the behavior of the CrowdStrike Falcon or Microsoft Defender for Endpoint real-time protection service scanning executable files in the C:\Program Files directory. During peak business hours, these services frequently spawn child processes that mimic the LiuXingPing (Liu Xing Ping) heuristic patterns.
  • Filter/Exclusion: Add a process exclusion based on the parent image path: CrowdStrike Falcon Sensor.exe and MsMpEng.exe. Exclude alerts where the parent process is one of these known EDR agents.

• Scenario: Scheduled Patch Deployment via SCCM/Intune

  • Context: During the nightly maintenance window, Microsoft Endpoint Configuration Manager (SCCM) or Intune deploys updates to workstations. The deployment agent executes a temporary script that instantiates a process matching the rule’s signature while unpacking and installing patches in the background.
  • Filter/Exclusion: Create a time-based exclusion for alerts occurring between 02:00 AM and 06:00 AM local time on workstations, specifically filtering out processes spawned by ccmexec.exe or IntuneManagementExtension.exe.

• Scenario: Legacy Reporting Tool Execution

  • Context: The finance department utilizes a legacy reporting tool (e.g., SAP BusinessObjects or Tableau Server) that relies on an older runtime environment. This tool periodically generates PDF reports using a specific engine that triggers the NsPacKV30LiuXingPing signature due to its memory allocation patterns during data processing.
  • **Filter/Exclusion