PseudoSigner01CDCopsIIAnorganix

Hunt Hypothesis

This detection identifies suspicious code signing artifacts associated with the “PseudoSigner01CDCopsIIAnorganix” signature, which may indicate an adversary leveraging legitimate-looking certificates to mask malicious executables or scripts within the environment. Proactively hunting for this behavior in Azure Sentinel is essential to uncover potential supply chain compromises or living-off-the-land tactics where attackers abuse trusted signing mechanisms to evade standard security controls.

YARA Rule

rule PseudoSigner01CDCopsIIAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 E9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PseudoSigner01CDCopsIIAnorganix detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Office 365 ProPlus Updates via SCCM

  • Context: The System Center Configuration Manager (SCCM) client service (ccmexec.exe) triggers the YARA rule when deploying Office updates. The update installer often utilizes a pseudo-signature mechanism that matches the “Anorganix” pattern during the extraction phase of the payload, even though the final binaries are fully signed by Microsoft.
  • Filter/Exclusion: Add an exclusion for the process ccmexec.exe when it is spawning child processes under the directory path C:\Program Files\Microsoft Intune Management Extension\. Alternatively, filter alerts where the parent process hash matches the known SCCM client SHA256.

• Scenario: Scheduled Antivirus Database Updates (CrowdStrike Falcon)

  • Context: The CrowdStrike Falcon Sensor (csfalcon.exe) performs nightly definition updates. During the download and unpacking of new threat intelligence feeds, the sensor’s internal updater module generates a temporary pseudo-signed artifact that triggers this rule. This is a routine maintenance task occurring between 02:00 and 04:00 UTC.
  • Filter/Exclusion: Create a time-based exclusion window (e.g., 02:00–05:00) for processes named csfalcon.exe or FalconService. Additionally, exclude file paths containing \CrowdStrike\Tools\Updates\.

• Scenario: PowerShell Script Execution by IT Operations Team

  • Context: The IT Ops team runs a scheduled PowerShell script (powershell.exe) to manage Active Directory user provisioning. This script utilizes the `Anorgan