PseudoSigner 02 ExeSmasher Anorganix

Hunt Hypothesis

This hypothesis targets the execution of malicious binaries disguised with pseudo-signatures by the ExeSmasher tool, a technique often used by threat actors to bypass signature-based defenses and establish initial footholds. Proactively hunting for these artifacts in Azure Sentinel allows the SOC to identify low-severity, stealthy intrusions that may have evaded standard alerting mechanisms, thereby reducing the risk of undetected lateral movement or persistence.

YARA Rule

rule PseudoSigner_02_ExeSmasher_Anorganix: PEiD
{
    strings:
        $a = { 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or operations engineer uses ExeSmasher (or a similar PE packer like UPX) to compress a custom internal utility or a small C#/.NET executable to reduce its size for distribution via a shared network drive or deployment script.

  • Filter/Exclusion: Exclude files located in specific development or build output directories (e.g., C:\Dev\Builds\, D:\CI\Artifacts\) or exclude processes where the parent process is a known build tool (e.g., msbuild.exe, dotnet.exe, python.exe running a packaging script).

• Scenario: An IT administrator deploys a legacy line-of-business application that was originally compiled with an older version of ExeSmasher or a similar packer to maintain compatibility with specific hardware or OS versions. The executable is signed with a valid enterprise certificate but retains the packed structure.

  • Filter/Exclusion: Exclude executables that have a valid digital signature from the organization’s internal CA (Certificate Authority) and are located in standard application installation directories (e.g., C:\Program Files\, C:\Program Files (x86)\).

• Scenario: A scheduled maintenance job runs a script that uses ExeSmasher to compress temporary diagnostic logs or small helper scripts before archiving them to a remote backup server. The compressed .exe or .bin file is created in a temporary directory and executed briefly.

  • Filter/Exclusion: Exclude files created in temporary directories (e.g., C:\Windows\Temp\, C:\Users\<User>\AppData\Local\Temp\) where the file age is less than 1 hour and the parent process is a known scripting engine (e.g., powershell.exe, cmd.exe, bash.exe).

• Scenario: