PseudoSigner01CodeLockAnorganix

Hunt Hypothesis

This detection identifies potentially malicious code signing activities where pseudo-signers exhibit anomalous locking behaviors indicative of supply chain compromise or certificate abuse. A proactive hunt is essential in Azure Sentinel to validate these low-severity signals against known good patterns, ensuring that subtle deviations in signing metadata do not mask early-stage adversary persistence within the software development lifecycle.

YARA Rule

rule PseudoSigner01CodeLockAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B E9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the PseudoSigner01CodeLockAnorganix detection rule, including suggested filters and exclusions:

• Scenario: Microsoft Defender Antivirus Signature Updates

  • Context: The Windows Update service (wuauserv) or the Microsoft Defender update engine (MpCmdRun.exe) frequently downloads and installs new malware definition signatures. These signature files often contain embedded code blocks that match the “CodeLock” pattern defined in the YARA rule, triggering alerts during daily maintenance windows (e.g., 02:00 AM).
  • Suggested Filter/Exclusion: Create a process exclusion for MpCmdRun.exe and wuauserv.exe. Additionally, add an IP-based exclusion if the traffic originates from known Microsoft update endpoints (e.g., *.download.windowsupdate.com).

• Scenario: Scheduled PowerShell Script Execution by Admins

  • Context: Enterprise administrators often deploy scheduled tasks via Task Scheduler that execute complex PowerShell scripts to manage user provisioning or patch compliance. These scripts frequently invoke the .NET runtime (powershell.exe or mscorsvw.exe) which may load dynamic assemblies containing code structures similar to the “Anorganix” signature, causing false hits during business hours (09:00 – 17:00).
  • Suggested Filter/Exclusion: Exclude alerts where the parent process is svchost.exe with the service name Schedule or where the user context matches a specific “Admin” group (e.g., DOMAIN\IT_Operations). Implement a time-based filter to suppress alerts occurring outside of known maintenance windows if the script execution is predictable.

• Scenario: Endpoint Detection and Response (EDR) Agent Self-Scans

  • Context: When the deployed EDR agent (e.g., CrowdStrike