PseudoSigner01MicrosoftVisualC60DebugVersionAnorganix

Hunt Hypothesis

This detection identifies potentially malicious binaries that are pseudo-signed with a Microsoft Visual C++ 6.0 debug version certificate, a technique often used by adversaries to evade signature-based defenses while maintaining a legitimate appearance. A SOC team should proactively hunt for this anomaly in Azure Sentinel because the use of outdated or non-production debug certificates is a strong indicator of supply chain compromise or custom malware designed to bypass standard trust mechanisms.

YARA Rule

rule PseudoSigner01MicrosoftVisualC60DebugVersionAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 51 90 90 90 01 01 90 90 90 90 68 [4] 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the detection rule PseudoSigner01MicrosoftVisualC60DebugVersionAnorganix, along with suggested filters and exclusions:

• Legacy Internal Build Server Execution

  • Scenario: An on-premise build server (e.g., Jenkins or TeamCity) running a nightly compilation job executes the msvcp60.dll library compiled in Debug mode during the final packaging stage of an internal legacy application. The binary lacks a commercial code signature, triggering the “PseudoSigner” alert due to its debug version string and Microsoft Visual C++ 6.0 origin.
  • Filter/Exclusion: Create a whitelist exclusion for the specific build server hostname (e.g., BuildServer-01) or exclude the full path of the internal build artifacts directory: \\FileShare\Legacy_Builds\Output\*.exe.

• Scheduled Database Maintenance Script

  • Scenario: A SQL Server maintenance job runs a custom VB6-based utility script at 2:00 AM to perform index optimization. This utility was developed in-house using Visual C++ 6.0 and is signed with an internal, self-signed certificate that the detection engine interprets as “Anorganix” (a pseudo-signer) because it does not match standard commercial signing authorities.
  • Filter/Exclusion: Exclude the scheduled task name SQL_Maintenance_VB6 or filter by process parent: sqlagent.exe. Additionally, add a specific hash exclusion for the utility binary if its SHA-256 is known and static.

• Third-Party Legacy Reporting Tool Installation

  • Scenario: The IT department deploys an update to a legacy reporting tool (e.g., Crystal Reports 10 or a custom BI dashboard) on finance workstations. The installer launches a background service (`