NsPacKV36LiuXingPing

Hunt Hypothesis

This detection identifies the presence of the Liu Xing Ping malware variant within the environment by leveraging a specific YARA signature to capture its unique behavioral artifacts. Proactive hunting for this threat in Azure Sentinel is essential to uncover early-stage infections that may evade standard heuristic scans, allowing the SOC team to isolate affected assets before lateral movement occurs.

YARA Rule

rule NsPacKV36LiuXingPing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D [5] 83 38 01 0F 84 47 02 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the NsPacKV36LiuXingPing detection rule in an enterprise environment, along with suggested filters:

• Scenario: Scheduled Antivirus Definition Updates via Microsoft Endpoint Manager

  • Context: The YARA signature likely matches a specific payload or behavior associated with the “Liu Xing Ping” (Star Rating) module within the NsPacK antivirus suite. In many enterprises, Microsoft Intune or SCCM triggers nightly definition updates that instantiate similar background processes or download temporary cache files matching this signature.
  • Suggested Filter: Exclude alerts where the ProcessName is IntuneManagementExtension.exe or ccmexec.exe and the ParentProcessName belongs to the Microsoft Endpoint Manager service group, specifically during the configured maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: Automated Backup Jobs Using Veeam or Commvault

  • Context: Enterprise backup agents often scan and compress large datasets containing embedded metadata or signature blocks that mimic the structure of the NsPacKV36LiuXingPing rule. When a backup job runs on a file server, it may trigger this YARA rule against temporary staging files created during the deduplication process.
  • Suggested Filter: Create an exclusion for processes running under the VeeamBRService or CommServe service accounts where the FileExtension is .tmp, .vbk, or .dsk, and the file size exceeds 50MB (indicating a bulk backup artifact rather than a standalone executable).

• Scenario: Deployment of Third-Party Security Agents via SCCM

  • Context: During the rollout or patching of third-party security tools (e.g., CrowdStrike, Carbon Black) using