PseudoSigner0132Lite003Anorganix

Hunt Hypothesis

This YARA rule targets specific binary artifacts associated with the PseudoSigner0132Lite003Anorganix signature, indicating the presence of potentially obfuscated or repackaged executables that may be used to establish a foothold or execute malicious logic. Proactively hunting for these signatures in Azure Sentinel allows the SOC team to identify low-severity anomalies and verify if these files are part of a known benign application or an emerging threat vector before they escalate in severity.

YARA Rule

rule PseudoSigner0132Lite003Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 [4] E9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses a lightweight, open-source code signing utility (e.g., osslsign or a custom Python script using pyOpenSSL) to sign build artifacts or container images in a CI/CD pipeline, where the binary or script contains a specific byte pattern matching the “PseudoSigner” heuristic.

  • Filter/Exclusion: Exclude processes running from the CI/CD agent directories (e.g., C:\Program Files\Jenkins\workspace\* or /var/lib/jenkins/workspace/*) or exclude parent processes like java.exe, node.exe, or python.exe when the target file path contains keywords like sign, build, or artifact.

• Scenario: An enterprise endpoint protection agent (e.g., CrowdStrike Falcon, Carbon Black, or SentinelOne) performs a self-test or integrity check on its own driver or helper binaries, temporarily creating a temporary signed file or modifying a signature block that matches the YARA rule’s byte sequence.

  • Filter/Exclusion: Exclude processes with known EDR service names (e.g., FalconService.exe, cb.exe, SentinelOneAgent.exe) or exclude file paths located in the vendor’s installation directory (e.g., C:\Program Files\CrowdStrike\* or C:\Program Files\SentinelOne\*).

• Scenario: A legacy application or internal tool uses a custom, non-standard code signing routine for internal license validation or plugin loading, where the signing algorithm produces a header or footer that coincidentally matches the “Anorganix” pattern defined in the rule.

  • Filter/Exclusion: Maintain a whitelist of known internal application binaries (e.g., InternalTool.exe, LegacyApp.dll) by SHA256 hash or specific file path, and exclude events where the source