PseudoSigner01MicrosoftVisualC70DLLAnorganix

Hunt Hypothesis

This rule identifies potentially malicious or obfuscated DLLs that masquerade as standard Microsoft Visual C++ 7.0 components, a technique often used by adversaries to blend in with legitimate system binaries and evade initial static analysis. Proactively hunting for these pseudo-signed artifacts in Azure Sentinel helps detect early-stage implantation or persistence mechanisms that leverage trusted file attributes to establish a foothold within the environment.

YARA Rule

rule PseudoSigner01MicrosoftVisualC70DLLAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 [4] E9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy .NET 1.1/2.0 Component Deployment: In environments still running legacy line-of-business applications, administrators may deploy older DLLs compiled with Visual C++ 7.0 (VS2003) that lack modern Authenticode signatures or use self-signed certificates.
  • Filter/Exclusion: Exclude paths under C:\Program Files\LegacyApp\ or specific known legacy application directories (e.g., C:\Inetpub\wwwroot\OldApp\bin\) where the file extension is .dll and the size is under 500KB.
• Third-Party Plugin/Extension Installation: Installing plugins for tools like Adobe Acrobat, JetBrains IDEs, or browser extensions (e.g., Chrome/Firefox extensions) often involves dropping small, unsigned or pseudo-signed DLLs into the user profile or plugin directories.
  • Filter/Exclusion: Exclude files located in user-specific plugin directories such as %LOCALAPPDATA%\Adobe\Acrobat\Plugins\, %USERPROFILE%\.config\Code\extensions\, or %APPDATA%\Mozilla\Firefox\Profiles\*\extensions\.
• Scheduled Maintenance/Backup Jobs: Automated backup agents (e.g., Veeam, Acronis) or maintenance scripts may temporarily extract or stage small utility DLLs in temporary directories (%TEMP%, C:\Windows\Temp\) during execution, which may appear unsigned or pseudo-signed due to the staging process.
  • Filter/Exclusion: Exclude files in C:\Windows\Temp\ or %TEMP% if the parent process is a known backup agent (e.g., veeamagent.exe, acronisagent.exe) or if the file name matches a pattern like *_temp_*.dll.
• Driver or Firmware Update Staging: Windows Update or vendor-specific update