PseudoSigner01JDPack1xJDProtect09Anorganix

Hunt Hypothesis

This rule targets executable files exhibiting characteristics of the PseudoSigner tool, which adversaries use to apply fake digital signatures to malicious binaries to bypass trust-based security controls. Proactively hunting for these artifacts in Azure Sentinel allows the SOC to identify stealthy payloads that may have evaded initial detection by masquerading as trusted software, thereby reducing the risk of undetected lateral movement or persistence.

YARA Rule

rule PseudoSigner01JDPack1xJDProtect09Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 E9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A development team uses 7-Zip or WinRAR to compress a large log archive (e.g., app_logs_20231027.zip) on a build server. The YARA rule’s generic byte patterns for “packers” or “signers” may match the internal structure of the ZIP container or the specific compression algorithm headers, triggering a false positive on a standard file transfer.
  • Filter/Exclusion: Exclude files with extensions .zip, .rar, .7z, or .tar.gz from this rule, or add a condition to ignore files larger than 50MB, as large archives are common in CI/CD pipelines.
• Scenario: An IT administrator runs Sysinternals Process Explorer or Process Monitor on a jump host to troubleshoot a service. These tools often load dynamic libraries or create temporary memory-mapped files that contain specific header strings matching the “PseudoSigner” or “JDProtect” patterns, especially if the tool itself is signed with a custom or legacy certificate.
  • Filter/Exclusion: Exclude processes or files originating from the C:\Sysinternals\ directory or known administrative tool paths (e.g., C:\Tools\, C:\Admin\), and whitelist specific executable names like procexp.exe or procmon.exe.
• Scenario: A scheduled task on a domain controller runs PowerShell to execute a maintenance script that downloads and executes a signed installer for Microsoft Defender for Endpoint or CrowdStrike Falcon. The installer package may be packed or obfuscated in a way that matches the YARA rule’s signature for “Anorganix” or “JDProtect” components, particularly if the installer uses a proprietary compression scheme.
  • Filter/Exclusion: Exclude files located in standard installation directories like `