PseudoSigner01FSG10Anorganix

Hunt Hypothesis

This rule detects the presence of the PseudoSigner01FSG10Anorganix YARA signature, which identifies a specific low-severity artifact or code pattern often associated with minor obfuscation or benign tooling that may be leveraged in initial access or living-off-the-land scenarios. Proactively hunting for this indicator in Azure Sentinel allows the SOC to distinguish between known low-fidelity signatures and potential stealthy adversary activity, ensuring that subtle deviations in file integrity or process behavior are not overlooked during routine monitoring.

YARA Rule

rule PseudoSigner01FSG10Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 68 [4] 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B E9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A development team uses a custom internal build tool (e.g., internal-ci-agent.exe) that embeds a specific cryptographic hash or string pattern matching the YARA rule to verify artifact integrity during the CI/CD pipeline.
  • Filter/Exclusion: Exclude processes where the parent process is msbuild.exe or dotnet.exe and the command line contains /t:Rebuild or --build, or exclude files located in the C:\BuildAgent\ directory tree.
• Scenario: An enterprise endpoint protection agent (e.g., CrowdStrike Falcon or SentinelOne) performs a real-time scan of a large log file or database backup, causing the YARA engine to match a transient memory buffer or file header that coincidentally matches the rule’s pattern.
  • Filter/Exclusion: Exclude detections where the process name is falconctl.exe, falconctl64.exe, sentinelone.exe, or s1agent.exe, and the file extension is .log, .bak, or .db.
• Scenario: A scheduled PowerShell job runs daily to rotate application logs, and the script uses a third-party compression library (e.g., 7z.exe or tar.exe) that includes a known signature string in its binary header, triggering the rule on the executable itself rather than the data being processed.
  • Filter/Exclusion: Exclude detections where the file path matches C:\Program Files\7-Zip\7z.exe or C:\Windows\System32\tar.exe, and the parent process is powershell.exe or pwsh.exe with a command line containing Compress-Archive or --create.
• Scenario: A Java-based application server (e.g., Tomcat or WildFly) loads a JAR file that contains a native library or