PseudoSigner01MEW11SE10Anorganix

Hunt Hypothesis

This detection identifies potential code signing anomalies or obfuscated executables flagged by the specific Anorganix YARA signature, which may indicate an adversary attempting to bypass trust mechanisms through pseudo-signing techniques. Proactively hunting for this behavior in Azure Sentinel is essential to uncover early-stage supply chain compromises or stealthy malware that leverages legitimate-looking signatures to evade standard security controls.

YARA Rule

rule PseudoSigner01MEW11SE10Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 E9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the PseudoSigner01MEW11SE10Anorganix detection rule, along with targeted filters and exclusions:

• Scenario: Automated Build Pipeline Execution

  • Context: CI/CD platforms like Jenkins, GitLab Runner, or GitHub Actions frequently execute build scripts that invoke the .NET runtime (dotnet.exe) to compile applications. These processes often generate temporary assemblies with pseudo-signatures that match the rule’s heuristic for “Anorganix” patterns during the compilation phase.
  • Filter/Exclusion: Add a process exclusion for jenkins-agent.exe and gitlab-runner.exe (or specific container IDs) running in the build cluster directory (C:\ProgramData\Jenkins\workspace). Alternatively, filter based on the parent process being svcmon.exe or dockerd.exe.

• Scenario: Enterprise Antivirus Scheduled Scans

  • Context: During off-hours, Microsoft Defender for Endpoint or Symantec Endpoint Protection performs deep heuristic scans. The scanning engine itself may instantiate a helper service that mimics the signature structure of the target rule while analyzing large .NET assemblies in shared network drives.
  • Filter/Exclusion: Exclude processes named MsMpEng.exe (Defender) and Rtvscan64.exe (Symantec). Apply this exclusion specifically when these processes are running under the context of a scheduled task (e.g., Task Name containing “Daily Scan”) or when the file path resides in the antivirus quarantine folder.

• Scenario: Database Backup and Maintenance Jobs

  • Context: SQL Server Agent jobs often trigger maintenance tasks that utilize .NET-based tools for data integrity checks or backup compression. These tools may load custom DLLs with pseudo-signatures that trigger the