PseudoSigner 02 Lockless Intro Pack Anorganix

Hunt Hypothesis

This hypothesis targets the execution of the PseudoSigner 02 Lockless Intro Pack, a known malware component associated with the Anorganix family that often leverages lockless mechanisms to maintain persistence or evade detection. Proactively hunting for this specific YARA signature in Azure Sentinel allows the SOC to identify early-stage infections or lateral movement attempts before the adversary can establish a foothold or escalate privileges within the environment.

YARA Rule

rule _PseudoSigner_02_Lockless_Intro_Pack_Anorganix: PEiD
{
    strings:
        $a = { 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A software development team uses Visual Studio Code or JetBrains Rider to build a custom internal tooling library that includes a C++ or C# wrapper for the “Anorganix” data processing SDK. The compiler (e.g., cl.exe or csc.exe) generates a binary where the string constants for the “Lockless Intro Pack” module are embedded in the .rdata section, triggering the YARA signature.

  • Filter/Exclusion: Exclude processes where the parent process is a known IDE compiler (e.g., cl.exe, csc.exe, msbuild.exe) or where the file path resides in a standard build output directory (e.g., *\bin\Debug\*, *\obj\*).

• Scenario: An IT operations team deploys a custom PowerShell script via SCCM or Intune to patch a legacy application that uses the “PseudoSigner” authentication library. The script downloads a small helper executable (anorganix_helper.exe) to a temporary folder (%TEMP%) to perform a one-time license validation, which contains the specific byte pattern for the “Lockless Intro Pack”.

  • Filter/Exclusion: Exclude files located in temporary directories (%TEMP%, %TMP%) if the parent process is a known deployment agent (e.g., CCMExec.exe, IntuneAgent.exe) and the file age is less than 1 hour.

• Scenario: A data science team runs a Python script using Cython to compile a performance-critical module that interfaces with the Anorganix C-API. The resulting .pyd or .so file contains the “PseudoSigner 02” magic string in its metadata header, which the YARA rule matches.

  • **Filter/Ex