PseudoSigner01LCCWin32DLLAnorganix

Hunt Hypothesis

This hunt detects anomalies in Win32 DLL signing processes where pseudo-signers exhibit irregular certificate patterns that may indicate supply chain compromise or code injection by adversaries. A proactive search is essential to identify early-stage lateral movement or persistence mechanisms that evade standard signature-based detection within the Azure Sentinel environment.

YARA Rule

rule PseudoSigner01LCCWin32DLLAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 [4] E9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PseudoSigner01LCCWin32DLLAnorganix detection rule, focusing on legitimate enterprise activities that mimic pseudo-signing behavior in Win32 DLLs:

• Scenario: Legacy Internal Tool Deployment via SCCM

  • Context: The IT Operations team deploys a custom internal utility (e.g., AssetTagger.dll) using Microsoft Endpoint Configuration Manager (SCCM). This legacy tool was originally signed with an older, self-managed certificate that lacks the specific chain of trust expected by modern strict validation logic, causing it to be flagged as “anorganix” or pseudo-signed.
  • Suggested Filter/Exclusion: Create a file hash exclusion for the specific SCCM deployment package ID and the known SHA256 hashes of AssetTagger.dll located in C:\Program Files\InternalTools\. Alternatively, exclude processes spawned by ccmsetup.exe or wuauserv.exe when loading this specific DLL path.

• Scenario: Scheduled PowerShell Maintenance Job

  • Context: A nightly scheduled task runs a PowerShell script (MaintenanceCleanup.ps1) that dynamically loads a third-party .NET assembly (e.g., Quest.ActiveRoles.dll). The assembly is signed by a vendor using a certificate that the detection rule interprets as “pseudo” due to an intermediate CA mismatch, triggering the alert during the 2:00 AM maintenance window.
  • Suggested Filter/Exclusion: Implement a time-based exclusion (e.g., 01:30–04:30) for alerts originating from powershell.exe processes running under the “SYSTEM” or specific service account context (NT SERVICE\TaskScheduler). Additionally, whitelist the specific file path of the .NET assembly if it resides in a known vendor directory (e.g., `C