NsPacKV31LiuXingPing

Hunt Hypothesis

This hunt investigates potential Liu Xing Ping malware activity by leveraging a specific YARA signature to identify known malicious patterns within endpoint telemetry. Proactive hunting for this indicator is essential in Azure Sentinel to detect early-stage infections that may evade standard heuristic-based detections due to their low severity classification and evolving threat landscape.

YARA Rule

rule NsPacKV31LiuXingPing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D [4] 8A 03 3C 00 74 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the NsPacKV31LiuXingPing detection rule, along with recommended filters and exclusions:

• Scenario: Antivirus Engine Self-Scanning

  • Context: The primary endpoint protection agent (e.g., CrowdStrike Falcon or Microsoft Defender) performs a scheduled deep scan of its own installation directory. During this process, the engine’s internal updater module (falcon.sys or MsMpEng.exe) spawns child processes that match the YARA signature patterns of the LiuXingPing behavior.
  • Filter/Exclusion: Add an exclusion for the specific parent process ID (PPID) of the AV service. Configure the rule to ignore alerts where the parent process is falcon.sys or MsMpEng.exe.

• Scenario: Automated Patch Deployment via SCCM

  • Context: System Center Configuration Manager (SCCM/MECM) executes a nightly patch deployment task sequence. The deployment agent (ccmexec.exe) extracts and installs updates, triggering file system changes and process creation that mimic the rule’s detection logic for legitimate software installation activities.
  • Filter/Exclusion: Create a filter to exclude events where the command line contains TaskSequence or the parent process name is ccmexec.exe. Additionally, whitelist the specific SCCM deployment agent path (e.g., C:\Windows\CCM\).

• Scenario: Database Backup Utility Execution

  • Context: A scheduled job using Veeam Agent for Microsoft Windows runs to perform an incremental backup of critical SQL databases. The utility (veeamagent.exe) creates temporary snapshot files and spawns helper processes that exhibit the same memory footprint and file access patterns as the target rule.
  • Filter/Exclusion: Exclude alerts originating from the Veeam service group or