PseudoSigner 02 DEF 10 Anorganix

Hunt Hypothesis

This hypothesis targets the execution of unsigned or pseudo-signed binaries associated with the Anorganix family, which adversaries often use to establish initial footholds or execute payloads while evading basic signature-based defenses. Proactively hunting for these specific YARA matches in Azure Sentinel allows the SOC team to identify low-severity anomalies that may indicate early-stage reconnaissance or the deployment of custom tooling before they escalate into more significant compromise activities.

YARA Rule

rule PseudoSigner_02_DEF_10_Anorganix: PEiD
{
    strings:
        $a = { BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A legacy Java-based application server (e.g., Tomcat or JBoss) loads unsigned or self-signed JAR files during the startup sequence or when dynamically deploying new microservices. The YARA rule may match the specific byte patterns of the META-INF/MANIFEST.MF or class files in these JARs if they lack a valid Authenticode signature.
  • Filter/Exclusion: Exclude file paths ending in .jar located within standard application server directories (e.g., C:\Program Files\Apache Tomcat\*, C:\opt\jboss\*) or where the parent process is a known Java runtime (java.exe, javaw.exe).
• Scenario: Development teams use local build tools like Maven or Gradle to compile and package applications. The intermediate build artifacts or temporary cache directories (e.g., .m2\repository, ~/.gradle/caches) often contain unsigned JARs or class files that match the “Anorganix” pattern before the final signing step occurs.
  • Filter/Exclusion: Exclude files located in user-specific build cache directories (e.g., %USERPROFILE%\.m2\*, %USERPROFILE%\.gradle\*) or where the parent process is a build tool (mvn.cmd, gradle.bat, npm.exe).
• Scenario: Automated backup or archival processes using tools like Veeam, Commvault, or Windows Server Backup create temporary staging files or compressed archives (.zip, .tar) that contain unsigned binaries. If the YARA rule scans the contents of these archives or the temporary extraction folders, it may flag legitimate backup data.
  • Filter/Exclusion: Exclude file paths containing keywords like backup, archive, or staging (e.g., `C:\Backup