PseudoSigner01MicrosoftVisualC620Anorganix

Hunt Hypothesis

This detection identifies potentially malicious executables that exhibit anomalous code signing characteristics, specifically those mimicking Microsoft Visual C++ 6.20 signatures with irregular signer metadata. Proactive hunting for this behavior in Azure Sentinel is essential to uncover stealthy adversaries who leverage legitimate-looking compiler artifacts to bypass initial trust mechanisms and establish a foothold within the environment.

YARA Rule

rule PseudoSigner01MicrosoftVisualC620Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 68 [4] 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 55 8B EC 83 EC 50 53 56 57 BE 90 90 90 90 8D 7D F4 A5 A5 66 A5 8B }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PseudoSigner01MicrosoftVisualC620Anorganix rule, including suggested filters and exclusions:

• Scenario: Scheduled Antivirus Engine Updates

  • Context: Enterprise antivirus solutions like CrowdStrike Falcon or Symantec Endpoint Protection frequently download update definitions during off-hours. These updates often include new engine binaries compiled with the Microsoft Visual C++ 6.20 runtime, which may lack a full code signature chain but possess valid pseudo-signatures matching the rule’s logic.
  • Filter/Exclusion: Create an exclusion based on the process name and parent process. Exclude files where ProcessName matches falcon.sys, SymantecEngine.exe, or ccSetPwd.exe AND the file extension is .dll or .sys.

• Scenario: Deployment of Internal Line-of-Business (LOB) Tools

  • Context: The IT Operations team deploys custom internal utilities using Microsoft SCCM (Configuration Manager) or Intune. These tools are often developed by internal contractors using legacy Visual Studio templates, resulting in executables that trigger the “anorganix” detection due to non-standard signing practices common in internal builds.
  • Filter/Exclusion: Implement a whitelist based on the Publisher and Installation Source. Exclude files where OriginalFileName contains specific internal prefixes (e.g., LOB_, IT_Ops_) and the installation source path is within the standard corporate software distribution folder (e.g., C:\ProgramData\SCCM\Cache).

• Scenario: Automated Database Backup Jobs

  • Context: Scheduled tasks running via Windows Task Scheduler trigger backup agents such as Veeam Agent for Windows or Commvault. These agents often spawn temporary helper processes