This detection identifies potential malicious activity involving a pseudo-signed executable mimicking Macromedia Flash Projector components, which adversaries often use to evade signature-based defenses and establish persistence. SOC teams should proactively hunt for this pattern in Azure Sentinel to uncover stealthy initial access attempts that may be overlooked by standard low-severity alerts due to their legitimate appearance.
rule PseudoSigner01MacromediaFlashProjector60Anorganix
{
meta:
author="malware-lu"
strings:
$a0 = { 90 90 90 90 68 [4] 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C E9 }
condition:
$a0 at pe.entry_point
}
This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Here are 5 specific false positive scenarios for the PseudoSigner01MacromediaFlashProjector60Anorganix detection rule, including suggested filters and exclusions:
Legacy Digital Signage Deployment
C:\Program Files\DigitalSignage\FlashProjector60.exe and restrict the rule trigger to only apply when the process is launched by the service account svc-digital-signage.Automated LMS Content Rendering
LMS-Server-Pool, or exclude the parent process svchost.exe when it spawns the Flash Projector binary.Internal HR Onboarding Tool Execution