PseudoSigner01DEF10Anorganix

Hunt Hypothesis

This rule identifies the presence of the “PseudoSigner01DEF10Anorganix” YARA signature, which typically indicates a specific malware family or tooling used by adversaries to execute malicious code or establish persistence. Proactively hunting for this signature in Azure Sentinel allows the SOC team to detect low-severity threats that may have been missed by standard detections, ensuring early identification of potential compromise vectors before they escalate.

YARA Rule

rule PseudoSigner01DEF10Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 E9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses a legitimate code signing utility (such as signtool.exe or osslsigncode) to sign a custom internal build or a test artifact in a development or staging environment. The binary may contain specific header structures or string patterns that the YARA rule PseudoSigner01DEF10Anorganix misidentifies as a pseudo-signer due to its generic signature block layout.

  • Filter/Exclusion: Exclude processes where the parent process is signtool.exe, osslsigncode, or codesign and the command line arguments contain keywords like /sign, --sign, or -s. Additionally, exclude executions occurring in designated development or staging directories (e.g., C:\Dev\, /opt/staging/).

• Scenario: An enterprise application or middleware (such as a Java-based ESB, .NET service, or Python-based microservice) dynamically loads a native plugin or DLL that has been signed with a self-signed certificate or an internal CA. The YARA rule may trigger on the specific structure of the Authenticode signature block or the presence of certain cryptographic algorithm identifiers (e.g., SHA-256 with RSA) that are common in both pseudo-signers and legitimate internal tools.

  • Filter/Exclusion: Exclude files located in standard application installation directories (e.g., C:\Program Files\, C:\Program Files (x86)\, /usr/local/lib/) where the file extension is .dll, .so, .jar, or .pyd and the file size is less than a defined threshold (e.g., 10MB). Also, exclude if the file has a valid digital signature from a known internal CA issuer.

• Scenario: A scheduled maintenance job or backup utility (such as Veeam, Commvault,