NsPack14Liuxingping

Hunt Hypothesis

This hunt detects the presence of the Liuxingping malware family, which is known for its ability to establish persistence and exfiltrate sensitive data through network channels. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify early-stage infections before they escalate into significant data breaches or lateral movement events within the cloud environment.

YARA Rule

rule NsPack14Liuxingping
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 [2] 40 00 2D [2] 40 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the NsPack14Liuxingping detection rule in an enterprise environment, along with targeted filtering strategies:

• Scenario: Scheduled Antivirus Database Updates

  • Context: Enterprise endpoints running CrowdStrike Falcon or Microsoft Defender for Endpoint often trigger the NsPack signature during nightly automated definition updates. The update engine unpacks compressed payload archives that mimic the structural characteristics of the Liuxingping malware family.
  • Filter/Exclusion: Create a whitelist rule excluding processes originating from known antivirus service paths (e.g., C:\Program Files\CrowdStrike\ or C:\ProgramData\Microsoft\Windows Defender\) when the parent process is identified as falconupdater.exe or MsMpEng.exe.

• Scenario: Software Deployment via SCCM/Intune

  • Context: During mass software deployments using Microsoft Endpoint Configuration Manager (SCCM) or Intune, the deployment engine extracts .msi or .cab packages containing nested archives. The YARA rule may flag these extraction activities as suspicious packing behavior similar to NsPack14Liuxingping.
  • Filter/Exclusion: Exclude alerts where the parent process is ccmsetup.exe, TaskHost.exe, or intune-management-agent-rt.exe and the file extension being scanned is .msi, .cab, or .zip.

• Scenario: Backup Agent Archive Creation

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik frequently generate large, nested archive files during incremental backup jobs. The compression algorithms used by these agents often match the entropy and header signatures detected by this specific YARA rule.
  • Filter/Exclusion: Implement a filter to suppress alerts