PseudoSigner01MinGWGCC2xAnorganix

Hunt Hypothesis

This detection identifies potentially malicious binaries compiled with MinGW GCC that exhibit anomalous code signatures inconsistent with legitimate Anorganix software patterns. A proactive hunt is essential to uncover stealthy supply chain compromises or custom malware leveraging these specific compiler artifacts before they escalate within the Azure Sentinel environment.

YARA Rule

rule PseudoSigner01MinGWGCC2xAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 E9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the PseudoSigner01MinGWGCC2xAnorganix detection rule, along with suggested filters and exclusions:

• Internal DevOps Build Artifacts

  • Scenario: The CI/CD pipeline (e.g., Jenkins or GitLab Runner) compiles internal microservices using the MinGW-w64 toolchain. These binaries are often signed with a generic internal certificate that matches the “PseudoSigner” profile, triggering alerts when deployed to staging servers.
  • Filter/Exclusion: Exclude processes originating from known build agents (e.g., jenkins-agent.exe, gitlab-runner.exe) or restrict the rule to only trigger on files located outside of designated build directories like C:\Builds\ and D:\Artifacts\.

• Scheduled Antivirus Definition Updates

  • Scenario: The enterprise endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender) performs a nightly update. The updater utility, often compiled with GCC/MinGW, extracts new definition databases that possess the specific signature characteristics of this rule.
  • Filter/Exclusion: Create an exclusion for the specific parent process names associated with the AV engine (e.g., C:\Program Files\CrowdStrike\fs_qr.exe or MsMpEng.exe) and exclude file paths matching *\Windows Defender\* or *\CrowdStrike\*\*.dat.

• Legacy Reporting Tool Execution

  • Scenario: A business intelligence team runs a scheduled nightly job using an internal reporting tool (e.g., a custom wrapper around Crystal Reports or Tableau) compiled with MinGW. The tool generates temporary executable reports that are signed by the same pseudo-signer used in the rule logic.
  • Filter/Exclusion: Implement a whitelist for specific user