PseudoSigner01ASProtectAnorganix

Hunt Hypothesis

This detection identifies potential code signing anomalies where executables exhibit characteristics of pseudo-signers or unorganized digital signatures, which may indicate an adversary attempting to bypass trust mechanisms by masquerading as legitimate software. A proactive hunt is essential in Azure Sentinel to uncover these subtle indicators that often evade standard signature-based defenses, allowing the SOC team to validate the authenticity of signed binaries before they execute within the environment.

YARA Rule

rule PseudoSigner01ASProtectAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD E9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the PseudoSigner01ASProtectAnorganix detection rule, including suggested filters and exclusions:

• Scenario: Scheduled Antivirus Engine Updates by AS Protect

  • Context: The enterprise deploys “AS Protect” (a mobile/endpoint security suite) which performs automated signature database updates via a scheduled task. During these updates, the asprotect.exe process often spawns child processes that generate pseudo-signatures matching the Anorganix pattern due to shared cryptographic libraries or embedded certificate chains.
  • Filter/Exclusion: Create an exclusion for the specific executable path of the AS Protect updater service (e.g., C:\Program Files\ASProtect\Updater\asprotect_updater.exe) and exclude any process tree where the parent is this updater service from triggering the rule during the defined maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: Microsoft Office Add-in Installation via Group Policy

  • Context: A global Group Policy Object (GPO) pushes a specific “Anorganix” branded productivity add-in to all workstations. The installation package utilizes the same pseudo-signing mechanism detected by the rule, causing alerts when the msiexec.exe or setup.exe processes install the add-in on user machines during logon.
  • Filter/Exclusion: Filter out events where the process name is msiexec.exe and the command line contains the specific Product ID (GUID) of the Anorganix Office Add-in, or exclude the installation directory path C:\Program Files\Anorganix\OfficeAddin\ entirely.

• Scenario: CI/CD Pipeline Artifact Signing in Dev Environments

  • Context: In the development environment, the internal CI/CD pipeline (e.g., Jenkins