PseudoSigner01MicrosoftVisualBasic5060Anorganix

Hunt Hypothesis

This detection identifies potentially malicious executables exhibiting anomalous code signing characteristics, specifically those utilizing Microsoft Visual Basic 5.060 with an “Anorganix” pseudo-signer that may indicate a spoofed or compromised certificate. Proactively hunting for this signature in Azure Sentinel is critical to uncover stealthy adversaries who leverage legitimate-looking metadata to evade standard security controls and establish persistence within the environment.

YARA Rule

rule PseudoSigner01MicrosoftVisualBasic5060Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 [4] E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 E9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the PseudoSigner01MicrosoftVisualBasic5060Anorganix detection rule, along with recommended filters:

• Scenario: Execution of Microsoft Visual Studio Build Tools or MSBuild processes during routine CI/CD pipeline runs.

  • Context: The YARA rule targets VB.NET compiled assemblies often generated by the Microsoft Visual Basic .NET compiler (version 5060). In enterprise environments, automated build agents frequently compile temporary .exe or .dll files that match this signature pattern without malicious intent.
  • Filter/Exclusion: Exclude processes where the parent process is msbuild.exe, vstest.console.exe, or dotnet.exe, and the file path resides within known build directories (e.g., C:\AzureDevOps\Agent_WorkingDirectory or D:\Builds\Drop).

• Scenario: Deployment of internal Line-of-Business (LOB) applications using ClickOnce or MSI installers.

  • Context: Many legacy enterprise applications are developed in-house using Visual Basic .NET and signed with a generic corporate certificate that matches the “Anorganix” or similar pseudo-signer profile. When these apps auto-update or launch via scheduled tasks, they trigger the rule due to their specific compiler fingerprint.
  • Filter/Exclusion: Create an exclusion for file paths containing specific internal application folders (e.g., C:\Program Files\InternalLOBApps\) and exclude files where the digital signature is valid from the organization’s Root CA (verified via PowerShell Get-AuthenticodeSignature).

• Scenario: Scheduled macro execution within Microsoft Office 365 environments.

  • Context: The rule may detect VBScript or VBA macros embedded in Excel or Access databases that are compiled on-the-fly by the Office suite. When