NsPacKV37LiuXingPing

Hunt Hypothesis

This detection identifies the presence of the Liu Xing Ping malware variant within Azure Sentinel by leveraging a specific YARA signature to flag potential initial access or persistence mechanisms. Proactively hunting for this indicator allows the SOC team to validate false positives and assess early-stage infection vectors before they escalate into broader lateral movement incidents.

YARA Rule

rule NsPacKV37LiuXingPing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D [4] ?? 80 39 01 0F [3] 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the NsPacKV37LiuXingPing detection rule, including recommended filters and exclusions:

• Antivirus Engine Signature Updates

  • Scenario: The enterprise endpoint protection suite (e.g., Microsoft Defender Antivirus or Symantec Endpoint Protection) performs a scheduled daily signature update. During the download and installation phase, the AV engine extracts compressed signature packages that contain binary structures matching the LiuXingPing heuristic pattern.
  • Filter/Exclusion: Add an exclusion for processes running under C:\Program Files\Microsoft Defender\ or C:\Symantec Endpoint Protection\. Specifically, exclude file paths containing \Updates\ or process names like MsMpEng.exe and Rtvscan64.exe during the 02:00–03:00 maintenance window.

• Patch Management Deployment (WSUS/SCCM)

  • Scenario: System Center Configuration Manager (SCCM) or Microsoft Update Services (WSUS) pushes a cumulative update to workstations. The deployment agent extracts the .msi or .cab payload, triggering the YARA rule on the temporary extraction folder where the LiuXingPing signature is detected within the installer’s embedded resources.
  • Filter/Exclusion: Exclude file paths located in C:\Windows\SoftwareDistribution\Download\ and C:\ProgramData\Microsoft\MSCCM. Additionally, apply a process exclusion for ccmsetup.exe, wuauserv.exe, and spoolsv.exe when they are executing with the “System” user context.

• Backup Agent Snapshot Operations

  • Scenario: The Veeam or Commvault backup agent initiates a volume shadow copy (VSS) to capture live databases. During the snapshot creation, the agent reads large