PseudoSigner01ASPack2xxHeuristicAnorganix

Hunt Hypothesis

This detection identifies potentially malicious executables exhibiting heuristic signatures of pseudo-signing and anomalous packaging structures often associated with early-stage supply chain compromises or obfuscated malware. A proactive hunt is essential in Azure Sentinel to uncover these subtle indicators before they escalate into active threats, as low-severity alerts may otherwise be overlooked during routine monitoring.

YARA Rule

rule PseudoSigner01ASPack2xxHeuristicAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 68 [4] 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PseudoSigner01ASPack2xxHeuristicAnorganix detection rule, including suggested filters and exclusions:

• Scenario: Microsoft Defender Antivirus (MSRT) Scheduled Scans

  • Context: The heuristic often flags the MpCmdRun.exe process when it executes a scheduled “Quick Scan” or “Full Scan” during off-hours. The rule detects the rapid unpacking of compressed signature databases and heuristic analysis as an “anorganix” (unusual) behavior pattern, specifically triggering on the pseudo-signature verification of temporary cache files.
  • Filter/Exclusion: Create a process exclusion for C:\Program Files\Windows Defender\MpCmdRun.exe where the command line contains /ScanType 3 (Quick Scan) or /ScanType 4 (Full Scan). Alternatively, exclude the specific YARA rule trigger if the parent process is svchost.exe with service name WdNisSvc.

• Scenario: SCCM (MECM) Application Deployment and Content Updates

  • Context: During a scheduled deployment window, System Center Configuration Manager agents (ccmexec.exe) download and unpack large application packages (.msi or .appx). The rule triggers when the agent extracts compressed content to the C:\Windows\CCMCache folder, interpreting the extraction of nested archives with varying digital signatures as an anomaly in the signing chain.
  • Filter/Exclusion: Exclude file paths matching C:\Windows\CCMCache\* from the detection logic. Additionally, add a filter to ignore alerts where the parent process is ccmexec.exe and the user context is NT AUTHORITY\SYSTEM.

• Scenario: JFrog Artifactory or Nexus Repository Agent Sync

  • Context: In